This error is caused by the heartbeat function. every 30 seconds the heartbeat will send to indexer. if the indexer don't get it during that time, the indexer writes a log with the timeout message. network devices like a firewall can causing this or long remote connections. I disabled the heartbeat. Other solution could be change the time frequency from 30 seconds... heartbeatFrequency = How often (in seconds) to send a heartbeat packet to the receiving server. Heartbeats are only sent if sendCookedData=true. * Defaults to 30 (seconds). It is a mechanism for the forwarder to to know that the receiver (ie indexer) is alive. If the indexer does not send a return packet to the forwarder, the forwarder will declare this receiver unreachable and not forward data to it. By default a packet is sent every 30s. Thank you ... View more

It's been a long time since I used a 5.x version of Splunk, but I believe the log location has not changed. You should find the logs at /opt/splunk/var/log/splunk, assuming you installed Splunk in the default location. Searching the indexed logs requires access to the _internal index. You may need to contact your Splunk admin to get access to that index. ... View more

If you are admin, why not look at splunkd.log? ... View more

So you have something like this ? homePath = volume:hot/$_index_name/db coldPath = volume:cold/$_index_name/colddb Your index needs to use the volume you have specified if you want the volume settings to work as per the indexes.conf documentation ... View more

@Damien Dallimore please find the below conf files in my system:- inputs:- [tcp-ssl://6514] connection_host = dns index = network sourcetype = cisco_udp disabled = 0 Props:- [mq] TRUNCATE=0 [log4j] TRUNCATE=0 And I dont have any transforms file. Please review and find me a solution for this. ... View more

Hello, skuma30 Could you solve this problem? If you solved, can you share your solution, because I have the same problem. Thanks! ... View more

Hi skuma30, Upgrading OPSEC LEA from version 2.x to 4.00 and later is tantamount to installing a completely new add-on. In a strict sense, you do not UPGRADE your old version to 4.0 and beyond but merely disable or uninstall your old add-on and install a new one. Therefore, if you do not disable or uninstall your old version (2.x) OPSEC LEA TA and still leave it running, of course you will still get data ingested into Splunk from that old TA. For information about OPSEC LEA upgrade, please refer to the Splunk documentation here: http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Releasehistory#Migration_guide Hope this helps. Thanks! Hunter ... View more

The link below explains how to configure Checkpoint OPSEC Lea. http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Setup#Create_the_OPSEC_application_certificate ... View more

Well thanks for the reply guys I tried both the settings but TIme_PREFIX,MAX_TIMESTAMP_LOOKAHEAD is working thanks for the replys once again and thanks jkat54. ... View more

If you are new, YourCurrentAppNameHere is probably search . ... View more

Why were u stopping splunk?? Any chance you were trying to enable ssl or install new certs?? ... View more

Thanku for the comment I will check with the user.. ... View more

Hi Hexx, I'm getting in the automatic lookups page when I add a new and running in the 6.2.1 version. Can this works in this version as well. ... View more

call not properly authenticated what does this mean when I try to debug the opsec lea. ... View more