Did you use '' at domain in the search query like "| ldapsearch domain= search=..." If you did, '*' will not work but have to specify the actual If you mean by '*', all attempted domains, that Error literally indicates that the ldap.conf does not have [] stanza. Basically 'default' domain in SA-ldapsearch is required configuration and also the 'default' domain should be functional in order to complete the Configuration. However, some other apps such as 'Splunk App for Windows Infrastructure' does not use the 'default' domain. If the SA-ldapsearch app does not have [] stanza, the 'Splunk App for Windows Infrastructure' will throw that error as well. "error_message=Cannot find the configuration stanza for domain= in ldap.conf" In the SA-ldapsearch Configuration, 'Alternate domain name' is essential field and should be unique. That means you cannot use the same 'Alternate domain name' in 'default' domain and domain. In that case, you may want to set up a different 'Alternate domain name' in 'default' and preferred name in domain. The 'ldap.conf' looks like below. [default] alternatedomain = DUMMY.COM basedn = dc=your_domain_name,dc=com binddn = CN=administrator,cn=users,dc=your_domain_name,DC=com port = 389 server = 192.168.100.100 ssl = 0 [your_domain_name] alternatedomain = YOUR_DOMAIN_NAME.COM ... View more

ITSI modules have deep_dive_drilldowns.conf with entity_activation_rules for the links. For example, OS Modules has below configuration. cat ./apps/DA-ITSI-OS/default/deep_dive_drilldowns.conf [OS Host Details] type = uri replace_tokens = true kpi_lane_enabled = true entity_level_only = true entity_activation_rules = [ \ { \ "rule_condition": "AND", \ "rule_items": [ \ { \ "field": "host", \ "field_type": "alias", \ "rule_type": "not", \ "value": "" \ }, \ { \ "field": "itsi_role", \ "field_type": "info", \ "rule_type": "matches", \ "value": "operating_system_host" \ } \ ] \ } \ ] :: According to the rule in deep_dive_drilldowns.conf, 'host' field can be empty but 'itsi_role' should be "operating_system_host" in order to activate "OS Host Details" link. If you add info Fields 'itsi_role' with 'operating_system_host' into entity rule, the link "OS Host Details" will come back. ... View more

You can change dbPath in local/server.conf. Here is another answers https://answers.splunk.com/answers/389298/relocate-kvstore-files-on-filesystem.html. ... View more

Splunk will create one database per collection and one db file will have one collection. (collections are specified in collections.conf) MongoDB Documents are restricted to 16MB in size. Thus each Splunk collection will have two db files (.0 and .ns) in 16MB in size respectively The db path is defined in server.conf. [kvstore] dbPath = $SPLUNK_DB/kvstore Hope this helps. ... View more

Try the following format TZ = CST ... View more