The following Bug had been logged with Product Management to clarify whether it was a Bug. SOLNESS-19368 iplocation has a field called 'lon' in Splunk and 'long' in Enterprise Security The response from Product Management (who confirmed it is not a Bug) is below: CIM uses "long", but Splunk Enterprise's geo-location search command outputs "lon". So the discrepancy itself is expected, we just missed the conditional eval component to align things properly. ... View more

The workaround is to disable health reporting in health.conf (until the Bug is fixed in Splunk 7.2.x). The issue is a known and is caused by the Bugs below. SPL-162549 splunkweb fails to start and SHC member shows as down Affects: 7.1.4 Fixed in: 7.1.6 SPL-160230 Splunkd web fails to start due to deadlock among Health Reporter threads Affects: 7.1.2 Fixed in: 7.1.6 Steps Make the changes to the file below: /etc/system/local/health.conf [clustering] disabled = 1 [feature:batchreader] disabled = 1 [feature:tailreader] disabled = 1 [feature:s2s_autolb] disabled = 1 [feature:indexers] disabled = 1 [feature:data_durability] disabled = 1 [feature:cluster_bundles] disabled = 1 [feature:indexing_ready] disabled = 1 [feature:data_searchable] disabled = 1 [feature:searchheadconnectivity] disabled = 1 [feature:replication_failures] disabled = 1 [feature:master_connectivity] disabled = 1 [feature:slave_state] disabled = 1 [feature:slave_version] disabled = 1 2.Restart Splunk. ... View more

It was found that Splunk OnPremise was installed on AWS and all of the ports were closed. Once port 8089 was opened replication resumed. The following Documentation Enhancement Request has been raised to be considered in a future release of Splunk. SPL-163427 Enhancement Request to check all ports are open in an Indexer Cluster/Search Head Cluster environment The default ports that Splunk uses are below. What are the ports that I need to open? https://answers.splunk.com/answers/58888/what-are-the-ports-that-i-need-to-open.html ... View more

The actual input stanza in the Universal Forwarder for WinRegistry is: WinRegMon Therefore, to disable WinRegistry input, please make changes to the following stanzas within your etc/apps/Splunk_TA_windows/local/inputs.conf on your Windows Universal Forwarder(s) that are sending out WinRegistry data to the indexers. ../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hklm_run] ../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1 ../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.* ../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows ../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .* ../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename ../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hkcu_run] ../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1 ../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\USER\.\Software\Microsoft\Windows\CurrentVersion\Run\. ../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows ../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .* ../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename ../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://default] ../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1 ../etc/apps/Splunk_TA_windows/local/inputs.conf hive = .* ../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows ../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .* ../etc/apps/Splunk_TA_windows/local/inputs.conf type = rename|set|delete|create So basically 'disabled = 0' switches it on and 'disabled = 1' switches it off. To stop WinRegistry set 'disabled = 1'. I note on the Splunk Server 'splunk' it is already disabled within etc/apps/Splunk_TA_windows/local/inputs.conf. Please make the changes above then restart your universal forwarder. ... View more

Concerning the '/brokers/ids' error you should not run: /opt/caspida/bin/Caspida start  Instead, run: /opt/caspida/bin/Caspida start-all  'caspida start' is usually used against an individual service name.  The documentation for this is included below for your future reference.  https://docs.splunk.com/Documentation/UBA/4.1.2/Install/DeploymentArchitecture An * indicates services that are started with the caspida start command and stopped with the caspida stop command. To start or stop all services, use caspida start-all or caspida stop-all.  e.g.  3 servers postgresql  caspida-jobagent*  hive-metastore  influxdb  impala-server  impala-catalog  impala-state-store  caspida-jobmanager*  etc. ... View more