Hi, I am upgrading an indexer from 7.2.6 to 7.3.9 on a Windows 2012 R2 server. During the installation near the end of installation I see that the installer is rolling back the upgrade. Where do I find out why the installation is failing? I've done upgrades in the past, but never have I seen it rollback an installation. Thx. ... View more

Title says it all: Is Splunk Support for Active Directory 2.1.3 compatible with Splunk Enterprise 6.5.0? ... View more

We are using Splunk 6.2.6. I am using heavy forwarder at remote sites to forward data to a central indexer. To make sure data is received we are using the useACK=true attribute. On one of our sites, the connection is broken between the central indexer, so no forwarding can be completed. Now the heavy forwarder, which is used locally as a search head is getting handshake timeouts, and prevents all GUI communication. I would assume it is from failing to communicate to the central indexer. We have tried to comment out heavy forwarder's outputs.conf file thinking that after a restart it would then be able to communicate....No such luck. So....When a backlog of events to forward to an indexer builds up in a heavy forwarder, is there some file/directory we can delete to remove the backlog, and restore normal GUI communication? ... View more

We are trying to put our Splunk Indexer on a Windows system image. Based on the documentation, stopping the Splunk service and issuing the .\splunk clean all command should clean out everything so the system image can be sysprep'd and in the future reimaged elsewhere. When we do this we see that the original server name still exists in the cloned image upon startup. Shouldn't the clean all command clean out the following? 1) var\log\splunk\ directory 2) var\lib\splunk\* directories 3) var\run\splunk* directory I'm guessing that even if it did the above directories, that it would be some manual effort to clean out the following user/app directories: 1) etc\apps\splunk_management_console\lookups\assets.csv 2) etc\users\admin\launcher\history.csv 3) etc\users\admin\search\history.csv 4) etc\users\admin\splunk_app_windows_infrastructure\history.csv I don't think the users\admin directories would cause problems, but the splunk_management_console lookup file now has the template windows image server name in its assets file, when it wont exist in the deployment. So would the best practice be to search for the template server name anywhere in the splunk deployment prior to running sysprep cloning the image? thx. ... View more

Hi, I have a batch stanza in my inputs.conf file of my application. I would like to use it to remove old files from the application that could be causing problems for the users. Here is an example: [batch://C:\Program Files\Splunk\etc\apps\<myApp>\local\ui\views\Old_View_File.xml] disabled = false queue=nullQueue move_policy=sinkhole It appears that Splunk is noticing the requested input, due to the _internal DB log files, but the requested file is not being processed and removed. Any suggestions? Thx. ... View more