FYI, the page I am hitting is HTTP ... View more

I'm having the same issue. in Chrome I get "Report not available" ... View more

Here is from splunkd.log: 09-16-2015 09:15:38.908 -0500 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 70, in init\n hand.execute(info)\n File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\css_setup_handler.py", line 72, in handleList\n job = jobs.oneshot('search sourcetype=cisco:asa OR sourcetype=cisco:fwsm OR sourcetype=cisco:pix | head 1 | stats count')\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\client.py", line 2992, in oneshot\n **params).body\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\client.py", line 764, in post\n return self.service.post(path, owner=owner, app=app, sharing=sharing, **query)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 240, in wrapper\n return request_fun(self, *args, **kwargs)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 62, in new_f\n val = f(*args, **kwargs)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 658, in post\n response = self.http.post(path, all_headers, **query)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 1090, in post\n return self.request(url, message)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 1107, in request\n response = self.handler(url, message, **kwargs)\n File "D:\Program Files\Splunk\etc\apps\Splunk_CiscoSecuritySuite\bin\splunklib\binding.py", line 1225, in request\n connection.request(method, path, body, head)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 995, in request\n self._send_request(method, url, body, headers)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 1029, in _send_request\n self.endheaders(body)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 991, in endheaders\n self._send_output(message_body)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 844, in _send_output\n self.send(msg)\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 806, in send\n self.connect()\n File "D:\Program Files\Splunk\Python-2.7\Lib\httplib.py", line 1194, in connect\n self.timeout, self.source_address)\n File "D:\Program Files\Splunk\Python-2.7\Lib\socket.py", line 571, in create_connection\n raise err\nerror: [Errno 10061] No connection could be made because the target machine actively refused it\n 09-16-2015 09:15:38.908 -0500 ERROR AdminManagerExternal - Unexpected error "" from python handler: "[Errno 10061] No connection could be made because the target machine actively refused it". See splunkd.log for more details. 09-16-2015 09:15:38.908 -0500 ERROR SetupAdminHandler - Error while fetching url=/servicesNS/nobody/Splunk_CiscoSecuritySuite/css_setup/css_setup_endpoint/default/?_strict=true;search=%20eai%3Aacl.app%3D%22%22%20OR%20eai%3Aacl.app%3D%22Splunk_CiscoSecuritySuite%22 ... View more

Here is the message from web_service.log 2015-09-16 09:15:39,203 INFO [55f97985764791710] _cplogging:55 - [16/Sep/2015:09:15:39] HTTP Request Headers: ACCEPT-ENCODING: gzip HOST: mysplunkserver:8000 Remote-Addr: 127.0.0.1 ACCEPT-LANGUAGE: en-US,en;q=0.5 ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 USER-AGENT: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0 TE: chunked REMOTE-USER: admin X-SPLUNKD: hUiBwyxm3AE4gJBoBGgYsg== 5697549914204021642 lOs_g2^fM8g_HVPQfPb6okKJAd30lJ0^lhSDlCdy0^aNxW81brYmF8GgDIu1JbVjpwE96m978OzDvRnknKY_GCMdUgeWzlExcbr6b6S541A5mLeZvnTsFi1DfJ7ht8Yp2PA 0 DNT: 1 COOKIE: session_id_8000=83dc19cb677c7aaf8b399ed017c5b22f0b5fd364; splunkd_8000=lOs_g2^fM8g_HVPQfPb6okKJAd30lJ0^lhSDlCdy0^aNxW81brYmF8GgDIu1JbVjpwE96m978OzDvRnknKY_GCMdUgeWzlExcbr6b6S541A5mLeZvnTsFi1DfJ7ht8Yp2PA; splunkweb_csrf_token_8000=5697549914204021642 REFERER: http://mysplunkserver:8000/en-US/app/Splunk_CiscoSecuritySuite/ 2015-09-16 09:15:39,220 DEBUG [55f97985764791710] _cplogging:55 - [16/Sep/2015:09:15:39] HTTP Traceback (most recent call last): File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\_cprequest.py", line 606, in respond cherrypy.response.body = self.handler() File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\cherrypy\_cpdispatch.py", line 25, in __call__ return self.callable(*self.args, **self.kwargs) File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\routes.py", line 366, in default return route.target(self, **kw) File "", line 1, in File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 38, in rundecs return fn(*a, **kw) File "", line 1, in File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 117, in check return fn(self, *a, **kw) File "", line 1, in File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 166, in validate_ip return fn(self, *a, **kw) File "", line 1, in File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 334, in preform_sso_check return fn(self, *a, **kw) File "", line 1, in File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 386, in check_login return fn(self, *a, **kw) File "", line 1, in File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 406, in handle_exceptions return fn(self, *a, **kw) File "", line 1, in File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\decorators.py", line 461, in apply_cache_headers response = fn(self, *a, **kw) File "D:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\controllers\admin.py", line 1620, in listEntities self.flattenElements(uiHelper['elements'], uiHelper_elements) KeyError: 'elements' ... View more

Thanks for the response. We are running Splunk Version 6.2.0, Splunk Build 237341 ... View more

I'm sorry, but I don't understand how to turn off SSLv3. Is that within Splunk? Java? Would that have changed sometime between Java 8 u25 and u31? As I mentioned before Splunk ran fine on Java 8 u25. Thanks! ... View more

Thanks for your response, somesoni2, As suggested, I tried: inputs.conf # DOTNET IIS LOGS [monitor://D:\Applications\*\*\W*\*.log] sourcetype = iis_group1 index = dotnet ignoreOlderThan = 5d disabled = false props.conf [iis_group1] pulldown_type = true MAX_TIMESTAMP_LOOKAHEAD = 32 SHOULD_LINEMERGE = False INDEXED_EXTRACTIONS = w3c detect_trailing_nulls = auto category = Web That makes the data look good, but it is still not pulling in the standard IIS field names; c_ip, cs_bytes, cs_method, cs_uri_query, cs_uri_stem, cs_User_Agent, cs_username, etc Results: Interesting Fields a d 15 # date_hour 1 # date_mday 1 # date_minute 1 a date_month 1 # date_second 12 a date_wday 1 ... View more

I have created different stanzas using different sourcetypes, but the only time I can get the field extractions to work correctly is if I use [iss] as the sourcetype. If i use something like [iss_group1], the field names do not get extracted correctly. Running the same query (index=dotnet) see the examples below: This one works using [iis] as the sourcetype: Inputs.conf # DOTNET IIS LOGS [monitor://D:\Applications\*\*\W*\*.log] sourcetype = iis index = dotnet ignoreOlderThan = 5d disabled = false props.conf [iis] INDEXED_EXTRACTIONS = w3c Returns: Interesting Fields a c_ip 1 # cs_bytes 100+ a cs_method 2 a cs_uri_query 25 a cs_uri_stem 86 a cs_User_Agent 4 a cs_username 3 a date 1 If I change that sourcetype to [iis_group1] and use INDEXED_EXTRACTIONS = w3c, Splunk does not properly extract the field names: inputs.conf: # DOTNET IIS LOGS [monitor://D:\Applications\*\*\W*\*.log] sourcetype = iis_group1 index = dotnet ignoreOlderThan = 5d disabled = false props.conf [iis_group1] INDEXED_EXTRACTIONS = w3c Returns Interesting Fields # date_hour 24 # date_mday 5 # date_minute 60 a date_month 1 # date_second 60 a date_wday 5 # date_year 1 a date_zone 1 ... View more

This is happening as well on my instance of Splunk 6.1.3. Any update on a fix? ... View more