This was exactly my issue. Thank you for the idea all these years later. Search "sourcetype="Perfmon*" | head 5" did not return any events in the last 24 hours Search "sourcetype="WinHostMon*" | head 5" did not return any events in the last 24 hours Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours Search "sourcetype="ActiveDirectory*" | head 5" did not return any events in the last 24 hours and so on... ... View more

And now I can't cancel my vote after one day... Sorry man. ... View more

Just tried on mobile and nothing? Not a big deal. ... View more

I downvoted this post because 404 on the link ... View more

Thank for the info on this. Question: Once the Splunk Universal Forwarder is installed (using any of the above workarounds), can SELinux be set to back to enforce 1 (enabled) or will the Splunk Universal Forwarder have issues running in the default /opt/splunkforwarder directory? In other words, are the workarounds only needed for installation and not regular operation? ... View more

I should say all of my forwarders are Windows with a mix of 5.0.3, 6.0, 6.0.1 and I just installed the 6.2 forwarder on a pair of servers (one W2K12R2 one WK8R2) - same deal. IP shows missing, DNS name shows active and looks "normal." Nick ... View more

Having the same issue... Upgraded from 6.1.4 to 6.2 and when I view "All Forwarders" in the Deployment Monitor app, I have every forwarder showing missing (listed as the forwarders' IP, pre 4.2, etc.) as well as active using DNS name (not FQDN). Looked at the answer here and it doesn't really make much sense to me. Nick ... View more

I should note that I simply deleted the app dir. in /etc/apps and installed from file via the UI and things worked fine after that. Nick ... View more

Seeing this on the latest version of S.o.S... 3.2 on Splunk Enterprise (Windows 2008R2) 6.1.4. Trying to upgrade via web UI from 3.1.0 to 3.2. When I try and update from the Apps Manager I get: An error occurred while installing the app: 500 When I try and update via Install app from file I get: There was an error processing the upload. This stuff gets so old lol... Nick ... View more

Correct - you need to throw the earliest/latest stuff before the first |... Nick ... View more

Nice - much easier than my way 🙂 Nick ... View more

I got this on Tuesday and they closed the case right away and I was unable to reply: Nick, This information has not been made available to support as of yet . That's all the information that we have . Regards, Charles I got this after emailing another engineer on a case I had open later on in the day Tuesday: Hi Nick, 6.1.4 should be out early Oct. PM decided to include that fix as part of the maintenance release and not create new patch. Best Regards, Michal. Hope this helps. Nick ... View more

If you want to use two days ago you'd use the following in your search: earliest=-2d@d latest=-1d@d This would give you events the entire day of the day two days ago. The -2d is how many days back. The @d "snaps" to the whole day if that makes any sense. You can use other units like seconds (s), minutes (m), hours (h), etc. Nick ... View more

This is killing me... If there is a hotfix or anything (beta) I'd love to get this fixed instead of waiting for the whole point release... Nick ... View more

No worries. I just wanted to make sure that was the proper path. I had talked to my reseller and he wasn't entirely clear either. Figured maybe I was doing something wrong to not get the download option. Nick ... View more

the first portion of the lookup definition should read like "this_field_is_in_the_lookup AS this_field_is_in_the_data". Thanks for the snip above! Nick ... View more

Thanks for the tip. This is continues to be something I wish had not changed in the UI. Nick ... View more

This is an old thread but seeing the same thing after upgrading to 6.0... Nick ... View more

+1 for searching the logs... Splunk on Splunk makes this much easier (in my opinion anyway). My issue was resolved viewing the splunkd.log file. ... View more

I had the same issue: updated from 5.0.4 to 6.0 and started seeing that error. Going through the logs using Splunk on Splunk (S.O.S.) sorting by ERRORS I found this in the splunkd.log: 11/26/13 2:12:16.801 PM 11-26-2013 14:12:16.801 -0600 ERROR loader - Deployment Server is not available, because errors prevented its initialization: 'Gap in numbered regexes: expected attribute=attrib.3 not found (context: stanza='serverClass:class_01')'. You can try to reload Deployment Server after correcting the errors. Using the config file viewer I used the chrome search function to find matching stuff (in my case "attrib") which turned up in the serverClass file. The issue was I had was I had skipped a number in the sequence (below, it goes 0 1 2 4 - should be 0 1 2 3). In the log you can see 'Gap in numbered regexes: expected attribute=attrib.3 not found (context: stanza='serverClass:class_01')' snip C:\Program Files\Splunk\etc\system\local\serverclass.conf attrib.0 = redacted00 C:\Program Files\Splunk\etc\system\local\serverclass.conf attrib.1 = redacted01 C:\Program Files\Splunk\etc\system\local\serverclass.conf attrib.2 = redacted02 C:\Program Files\Splunk\etc\system\local\serverclass.conf attrib.4 = redacted04 snip Going back through my backups I noticed that it's been that way for a long time. Seems like something is checking this file for errors now (I can only speculate as I have no clue). Hope this helps... Nick ... View more

Correct - I was more concerned with being able to make changes to a report I had opened. I missed the link in the GUI where it linked to "open in search" Nick ... View more

There is also an option in the report screen to open in search which is handy... ... View more

Edit button > Open in Search seems to be the only option I can figure out. Extra step but I can live with it... Nick ... View more