We are trying to monitor a lot of systems that have various configurations of drives, (C:disk 😧 cdrom, c:disk d: disk e: disk f: cdrom, etc). The issue we are seeing is that with the below inputs.conf we are getting millions of "device not ready" messages in _internal index when splunk tries to look at the CDrom drive. Is there any way to force splunk not to check the CD drive If we don't know what drive the CD is? (I can't change the drive letter of the CDrom, and I can't change what drive the data is on).. so somtiems d: is a hard drive, sometimes 😧 is a CDrom (and we get the errors). This is a problem with both monitor & batch. Thoughts? error: 12-21-2012 18:06:25.979 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "d:\splunk_logs\application": The device is not ready. inputs.conf: [batch://d:\splunk_logs\applicaton\*.txt|*.csv] move_policy = sinkhole disabled = false [batch://e:\splunk_logs\application\*.txt|*.csv] move_policy = sinkhole disabled = false ... View more

As far as efficiency, we were told that realtime searches take "a fraction" of a CPU core per search. Does it matter if someone is doing realtime-all time, or realtime-5min/30 min window? I was looking at http://www.splunk.com/view/real-time-in-splunk/SP-CAAAFD7 but wasn’t clear. Just confirming, if you do a rt30 minute search and you look for an event that follows another event and those events are >30 minutes apart, you wouldn’t see anything. Also, if you do realtime search for 30 minute window and events come into Splunk with different time greater than 30 minutes (e.g. timezone or bad CPU clock time) you won't see those as either. Thanks ... View more

We installed wildcard certificates on our search heads (*.company.com) issued by "Trusted Secure Certificate Authority" this weekend (good 8/8/12- 8/9/15) and the PDF server stopped working. Web browsers (IE/Firefox/chrome) have no issues with the certificate using the splunk web GUI. Splunk 4.3.3. PDF server 1.3 (re-downloaded today). PDF server is on local search head The error in the PDF email is: An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request Not quite the same error, I have tried this, and it still doesn't work: http://splunk-base.splunk.com/answers/56947/how-do-i-fix-the-pdf-server-on-43-when-using-a-self-signed-ssl-cert The logs in python.log are: 2012-09-04 13:03:30,644 ERROR PCDATA invalid Char value 26, line 164, column 1 Traceback (most recent call last): File "/opt/splunk/bin/rest_handler.py", line 84, in <module> print splunk.rest.dispatch(**params) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 52, in dispatch requestXml = et.fromstring(requestInfo) File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48634) File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:72245) File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:71106) File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67875) File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:64257) File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:65178) File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64521) XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1 2012-09-04 13:03:30,738 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request 2012-09-04 13:03:30,738 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763600_416e77d67eeee6a0?message_level=warn [] sessionSource=direct 2012-09-04 13:03:30,817 DEBUG simpleRequest < server responded status=200 responseTime=0.0781s 2012-09-04 13:03:30,817 DEBUG getStatus - elapsed=0.0789680480957 nextRetry=0.0500039395281 2012-09-04 13:03:31,248 INFO Sending email. subject="Splunk Alert: test_head1000" , results_link="https://lab.company.com:443/app/search/@go?sid=scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763600_416e77d67eeee6a0", recepients="['me@company.com']" ... View more

Any word on support for Splunk on Windows 2012? ... View more

I have a script that modifies the users so we can authenticate VIA SSO. I was hoping that splunk would reload auth by itself once in a while, but it seems like the only 2 ways to get the password file refreshed is to restart splunk or run splunk reload auth command. I would be OK with running reload auth command when the file gets updated, but I don't want to write a script with our admin username/password in it. So, any other alternatives. Is there a timeout to force splunk to refresh auth automatically, and/or what role capabilities are required in order to run the reload-auth command? Thanks ... View more