Do you mean to say to use the coalesce in place of the fieldalias definition? ... View more

Here is how to modify SA-ldapsearch for non-distributed mode: http://docs.splunk.com/Documentation/SA-LdapSearch/2.1.2/User/Workaroundfordefaultconfigstanzaerrorsindistributedenvironments ... View more

Assuming that (1) you're on Splunk 6.3 and (2) the SH has got access to ActiveDirectory this problem is easily solved by a one line change to each of the files: sa-ldapsearch/bin/ {ldapfilter.py,ldapgroup.py,ldapsearch.py,ldapfetch.py, ldaptestconnection.py} Here’s the change to make in each file: Change this: @Configuration() to: @Configuration(local=True) [If you already have something within the ()'s, just add the local=True to what's already there.] If you’re running on Splunk 6.2 or lower, you should add this line to each stanza in sa-ldapsearch/default/command.conf: local = true Save the files and restart the Splunk instance on the Search Head(s). Retest to verify the workaround worked. ... View more

The issue appears to a comment that was left in the default/inputs.conf file. I've filed bug MSAPP-1200 to get it fixed for the next update. Removing this comment and restarting the instance resolves the issue. # # Perfmon Collection #[perfmon://Processor] <----- This is the issue. object = Processor counters = * instances = * interval = 10 disabled = 0 index=perfmon [perfmon://Memory] object = Memory counters = * interval = 10 disabled = 0 index=perfmon [perfmon://Network_Interface] object = Network Interface counters = * instances = * interval = 10 disabled = 0 index=perfmon [perfmon://DNS] object = DNS counters = * interval = 10 disabled = 0 index=perfmon ... View more

Possible workaround for this bug: Check your props.conf files on the instance that is crashing due to this bug, and if there are any 'CHECK_METHOD = modtime or entire_md5, comment them out and restart the instance. Be sure to check under the app contexts as well. A customer found one under the *nix app, and that was the only occurrence he found (not under the default, that is). After commenting it out, it started up as expected. (The fix for SPL-58292 is expected to come in an upcoming maintenance release) ... View more