Hi @jreuter_splunk. Including @xpac, @Kyle_Jackson, @ben_leung, @tsteens, @muebel, @gjanders as well, since they were active on the "Is there a REST API call to apply shcluster-bundle with the deployer?" post as well. This solution is fairly old (neary 10 years). Now that we're in 9.x, is there another way to do this? I still wasn't able to find it in the REST API Reference Manual. ... View more

Thank you ... View more

My situation with this error: I had established my own certs (including a CACert.pem file) and placed them in a folder: /opt/splunk/etc/auth/my_certs ... and everything worked fine, except for ldap-search it was complaining of an 'invalid CA public key file' in the SA-ldapsearch/default folder is the file ssl.conf with an entry: [sslConfig] sslVersions = tls caCertFile = cacert.pm   Well.. because my CA cert was named "CACert.pem" -- the add-on couldn't find it. I copied my CACert.pem to 'cacert.pem' -- and everything worked well again.   @jreuter_splunk wrote: sslConfig is case sensitive. Indeed it is.      Good luck.     ... View more

I'm on Splunk 7.1.5 and I have not seen them so far. ... View more

Hello, I had this situation when the Splunk tgz wasn't fully extracted. I haven't used anything of the solution above ... View more

I have Splunk verision 6.4 and yet seeing this issue frequently on the SearchHead. I tried the Python fix on all the Search Heads and restarted them but No Use. The icons and menu items are frozen until your lucky to have a working user experience. I even tried on all browsers and tried the incognito mode as well. Any help is much appreciated. ... View more

It looks like this was a bug SPL-138909 "Ran out of data while looking for end of header- archive file" which has been fixed in the following releases: 6.5.6 + 6.6.4 + 7.0.2 + 7.1.0 + 7.2.0 + ... View more

They are pretty sneaky, and have bitten me more than once. I didn't even notice them on the first pass! ... View more

Hi kserra, Please, have you more information about the condition required for these cluster bundle deployment message to appear ? There is a user of the Nmon app mentioning the same message because of missing spec files: https://answers.splunk.com/answers/368524/spec-files-missing-for-nmon-performance-monitor-fo.html#answer-372022 Therefore, in my customers places running the app in indexer clustering or in my own env testing i have never met this message. Is this verification step specific to certain configuration ? version ? OS ? Thank you ! Guilhem ... View more

Hi Sunrej, I am getting the following error in SDK 1.5.0 Did you also get it? Or do you know how to resolve it? I have changed https to http in .splunkrc file. And I am using JRE7 java.lang.RuntimeException: Connection reset at com.splunk.HttpService.send(HttpService.java:427) at com.splunk.Service.send(Service.java:1293) at com.splunk.HttpService.post(HttpService.java:308) at com.splunk.Service.login(Service.java:1122) at com.splunk.Service.login(Service.java:1101) at com.splunk.Service.connect(Service.java:187) at com.splunk.examples.search.Program.run(Unknown Source) at com.splunk.examples.search.Program.main(Unknown Source) Caused by: java.net.SocketException: Connection reset at java.net.SocketInputStream.read(SocketInputStream.java:196) at java.net.SocketInputStream.read(SocketInputStream.java:122) at java.io.BufferedInputStream.fill(BufferedInputStream.java:235) at java.io.BufferedInputStream.read1(BufferedInputStream.java:275) at java.io.BufferedInputStream.read(BufferedInputStream.java:334) at sun.net.www.http.HttpClient.parseHTTPHeader(HttpClient.java:690) at sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:633) at sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:661) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1324) at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:468) at com.splunk.HttpService.send(HttpService.java:425) ... 7 more ... View more

Recommendation: Minimum of 1G for Data segment (ulimit -d) and for Resident memory (ulimit -m) ... View more

As jreuter stated, do not use maxHotSpanSec=86400. It has been proven this can cause undesired behavior if aligned with the hour or the day. ... View more