What I am trying to accomplish is to produce a report that will demonstrate the number of unique VPN users in our environment, organized per appliance. The search looks like this index=vpn index=vpn sourcetype=juniper_sa_log msg="Session started for user with" | stats dc(user) as "Users" by host | sort -num(Users) I was able to create the initial search easily; however I realized that because our VPNs appliances are clustered, each node sends logs separately, and in my search I sometimes end up having both nodes report the same users in the event a node failed over to the other. What I would like to do then is create one search that will provide the number of unique users per VPN cluster, by combining the logs for each cluster before reporting the distinct count. (i.e. return the distinct count of users where host=a +host=b) I have been researching for a few hours and coming up blank on this one. Any help would be appreciated. ... View more

I am getting an error when I restart splunk: Invalid key in stanza [WinEventLog:Application] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 16: start_from (value: oldest) Invalid key in stanza [WinEventLog:Application] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 17: current_only (value: 0) Invalid key in stanza [WinEventLog:Application] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 18: checkpointInterval (value: 5) Invalid key in stanza [WinEventLog:Security] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 22: start_from (value: oldest) Invalid key in stanza [WinEventLog:Security] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 23: current_only (value: 0) Invalid key in stanza [WinEventLog:Security] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 24: evt_resolve_ad_obj (value: 1) Invalid key in stanza [WinEventLog:Security] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 25: checkpointInterval (value: 5) Invalid key in stanza [WinEventLog:System] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 29: start_from (value: oldest) Invalid key in stanza [WinEventLog:System] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 30: current_only (value: 0) Invalid key in stanza [WinEventLog:System] in /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf, line 31: checkpointInterval (value: 5) I am not sure why I would be getting this error from the default folder. Is this expected, or is there a way to clean this up? Thanks, Casey ... View more

It was brought to my attention that our Splunk for Okta app stopped pulling in data. We are running Splunk 6.2.2, splunk for okta 2.0.1, and the splunk for okta plugin 2.0.0. This was working for several months, and I am unsure what caused data to stop being pulled in. I have checked and the scripts are enabled. Is there any logs I should search for that may help in determining what may be causing the issue? ... View more

I have configured the Cisco eStreamer app, and confirmed that logs are appearing in Cisco eStreamer logs are in $SPLUNK_HOME/etc/apps/eStreamer/log. I have enabled verbose logging, but no logs are apearing in the Cisco eStreamer app, and when I do a search for index=estreamer it comes up empty. Additionally, when check the "client status" in the app, no results are returned. I have manually checked the client_check.py, and the status comes back as event_sec=1414616228 status_id=1 status="eStreamer client is running." Also important: We have a distributed environment. I have tried to install the app on a search head and a heavy forwarder with no luck. I can not find any documentation so I am wondering if I need to install the app on an indexer instead. Any feedback would be appreciated. Thanks, Casey ... View more