I have a splunk indexer running on Linux that i recently upgraded to 4.2 and a lightforwarder running on a windows 2k8 that i upgraded to the universal forwarder. After the upgrade, the sedcmd line i have in the props.conf on my indexer doesn't appear to be working any more. I was using it to strip extraneous description text from server 2k8 logs. The logs are still showing up The line in props.conf looks like this: [wmi] SEDCMD-remwinstr = s/(?ism)(This event is generated|Certificate information is only provided).*//g I believe there is another question that has been asked that i think might be relevant as its happening here as well: Universal Forwarder: WMI Hostname Config Ignored For completeness, here is the wmi.conf file on the universal forwarder: [WMI:DomainControllerLogs] server = <host1>, <host2>, <host3>, <host4> interval = 10 disabled = 0 event_log_file = Security current_only = 0 ... View more

I am trying to run splunk as a non-root user, but every time i start splunk I get the error "splunkd: error while loading shared libraries: libxslt.so.1: cannot open shared object file: No such file or directory" I have created a user and group named "splunk" to run the server as. I have given it rights to read/write /opt/splunk. Even if I do: $ sudo -u splunk bash bash$ source /opt/splunk/bin/setSplunkEnv bash$ /opt/splunk/bin/splunk start I still get that error. As long as i set the $SPLUNK_HOME using setSplunkEnv, ldd correctly finds all the libraries on the system or in the /opt/splunk/lib/ directory. It does work fine when I start it as root. To make things more complicated, my sysadmins tell me that having /opt/splunk/lib in /etc/ld.so.conf breaks their Red Hat Network update stuff so they removed it. So, I tried the following before starting splunk: export LD_LIBRARY_PATH=/opt/splunk/lib which also results in ldd finding all the libraries, but I still get the error when starting splunkd. $ sudo -u splunk bash bash$ export LD_LIBRARY_PATH=/opt/splunk/lib bash$ source /opt/splunk/bin/setSplunkEnv bash$ /opt/splunk/bin/splunk start Splunk> All batbelt. No tights. Checking Prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking configuration... Done. Checking index directory... Done. Checking databases... Validated databases: _audit, _blocksignature, _internal, _thefishbucket, history, main, sample, summary, test Checking for SELinux All Preliminary checks passed. splunkd: error while loading shared libraries: libxslt.so.1: cannot open shared object file: No such file or directory ... View more

I am trying to remove the extra description text that gets appended to windows 2k8 logs using SEDCMD in props.conf. However, I can't seem to get it to work, no matter what i use as my expression. I am receiving events from a light forwarder on a windows box that is pulling the events using WMI from our domain controllers. The indexer is actually a linux box. This is what I have in props.conf [source::WMI:WinEventLog:Security] SEDCMD-remwinstr = s/(?ism)This event is generated.*$//g Nothing is being removed. I've tried all kinds of variations on both the stanza name as well as the regular expression itself. I've tried just [WMI:WinEventLog:Security], [WMI:WinEventLog*], [WMI*], and even the name of one of the hosts: [host::<hostname>] I've also tried different variations of the regex. Even something like this doesn't do any replacement: SEDCMD-remwinstr = s/(?ism)This/That/g I've tried with and without (single or double) quotes around the entire part after the = as well. Thoughts? ... View more