I found that reference. We are working through it and trying to see if that will solve the issue. ... View more

I worked through this one. If your users have a vpn client to connect to the network, they can access the mobile server and through the mobile server, the Splunk instance. ... View more

I ran into this problem. I installed the DCN, the connections all checked out green, and I was ready to go. I did a search and my VMwre app dashboard all came up with data. Brillant, so far. The Data Collection Node (DCN) that comes with Splunk has a 5GB disk. The default for for the dispatcher for doing searches is 5GB. What happened to me is that the VMware app came up, populated the dashboards, and then never collected another thing. The reason, revealed by tailing the splunkd.log file on the DCN is that there was not enough space on the virtual disk drive on the DCN VM. I solved it by having the VM admin up the space available to $SPLUNK_HOME directory on the DCN. Ultimately, I rolled my own DCN because the VMWare schema couldn't (or wouldn't) grow the VM directory. Splunk was in /home/splunk vice /opt/splunk. oh well. The other possible solution is to change the minimum disk space required for the dispatcher in Splunk when conduction searches. You could lower it to 2 GB and then start getting search data back. If you problem is similar to the one I encountered, this might help. ... View more

Check to see if your DCN has enough disk space in the $SPLUNK_HOME/ directory. The DCN vm ships with 5GB set, which is also the default minimum for the dispatcher to run. You can run a search or two, but then it runs out of space and you cannot search, that is, gather VMWare data at the DCN to forward to the VMWare App. You can increase the size of the $SPLUNK_HOME/ directory to fix it or configure the minimum disk space for the dispatcher to under 5 GB. The five GB limit makes it easier to ship the VM. A vm of say 10 GB storage would take up 10 GB and be harder to move around (5GB was hard enough). Try that and see if that helps solve the problem. ... View more

The work around for IE is: Click on the toothed cog in the upper right of the IE screen (just below the X) The drop down box gives you a menu. Choose “Compatibility View Settings” Uncheck the box “Display intranet sites in Compatibility View” IE should work after that. Or…just use Firefox. Rob Frazier CISSP, ISSAP, CSSA, CEREA ... View more

You must take the courses directly from Splunk. The good news is that the courses all have a virtual classroom offering. You can find a virtual course in a time zone that fits your schedule, and sign up for that course. But you MUST take the courses from Splunk and you must pass each course. The Splunk courses are prerequisites to sitting for the Splunk certification exams. Each certification has its own set of courses that must be taken from Splunk. Currently there is no "self-study then take the exam" path to Splunk certification. I can recommend a very good book for learning Splunk. "Splunk Operational Intelligence Cookbook" offers many recipes for creating Splunk queries that will help you understand Splunk and help you along to becoming an expert. ... View more

can a HF collect raw, unindexed files and then shovel it through? ... View more

Thanks! I had forgotten about that command. ... View more