×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
nathanhfraenkel
New Member
Member since: ‎06-20-2019
‎09-05-2023
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎06-20-2019
Activity Feed
View All

Deployed apps to Windows Forwarders are malformed

by in Getting Data In
‎09-01-2023 05:41 AM
‎09-01-2023 05:41 AM
Sometimes after an app has a change made to it when it is deployed to our Universal Forwarders on Windows computers the conf files are malformed. Specifically, the inputs.conf file has all the spaces removed and formatting removed and the forwarder does not use the file anymore. The only fix I have found is to delete the app from the forwarder and wait for the deployment server to re-deploy it. ... View more

Re: HKLM\SYSTEM\CurrentControlSet Monitoring

by in Alerting
‎06-20-2019 03:53 AM
‎06-20-2019 03:53 AM
There is already another post and answer to this question: This is a known issue - SPL-58682 - with Splunk monitoring the Current Control Set for this section. The work around is to use the following setting for hive: 1. hive = HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET\ENUM\USBSTOR?.* ... View more

Re: HKLM\SYSTEM\CurrentControlSet Monitoring

by in Alerting
‎06-20-2019 03:38 AM
‎06-20-2019 03:38 AM
I have the same problem. If I enable ControlSet001 and 002 works fine. As soon as I enable CurrentControlSet all three stop working. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎09-05-2023 07:30 AM