About cubicmotion

codebuilder · ‎04-30-2019

You have indexed more than 500MB of data. When that happens Splunk will disable searching. You'll need a new license, or a reset license.

adonio · ‎03-23-2019

thats what its for ... (among other things) read here: https://splunkbase.splunk.com/app/3734/#/details or better install it, bring the data and enjoy

richgalloway · ‎03-22-2019

@cubicmotion If your problem is resolved, please accept the answer to help future readers.

cubicmotion · ‎03-20-2019

I've downloaded the above TA to try and collect windows defender logs from my universal forwarders but I have no idea what to do with a TA. Can someone explain how on earth you setup a TA and get it to work on splunk LIGHT please?? Be as detailed as you can! Thanks

woodcock · ‎03-22-2019

Also be aware that there are some things that Splunk does that are not evident when the Splunk installation process happens and these will NOT happen if you manually unpack into the apps directory. For example, the family of seckit apps on Splunkbase will be completely broken if you manually unpack them. So you should never manually unpack and always use the proper CLI command: $SPLUNK_HOME/bin/splunk install app <path-to-app-tgz-or-spl-here> to upack for you (or the GUI method that I described in my other answer).

Posts	6
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎03-20-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Why is this error showing up" This pool has exceed...

Windows defender scan results

Data could not be written Error

Install TA for Microsoft Windows Defender on Splun...

Re: Why is this error showing up" This pool has ex...

Re: Windows defender scan results

Re: Data could not be written Error

Install TA for Microsoft Windows Defender on Splun...

Re: A guide to installing a Splunk TA at command l...

Are you a member of the Splunk Community?