I am using the same command and running as admin but getting only few users. We have nearly 50 but getting only 4-5. We use LDAP auth in our environment. Am I missing something? We create roles in deployer and push it to SHs  ... View more

https://help.splunk.com/en/splunk-enterprise/administer/manage-and-update-deployment-servers/staging-draft/configure-the-deployment-system/upgrade-pre-9.2-deployment-servers ... View more

this happened to me in a clustered and distributed environment.  I toggled from Distributed to Stand along and back to Distributed then clicked apply changes.  Cleared right up. ... View more

For the protocol, version 9.2.2 doesn't help either. ... View more

The developer made a release available and gave a talk on it some months ago at one of the user groups. I tried it then and it generally worked OK, but didn't give it some hard problems to look at. It's running in a Cloud instance I have access to. ... View more

(how do I give negative Karma?)   ... View more

You may want to increase maxQueueSize in outputs.conf. The logs is indicating blocking due to low tcpout queue size or target is causing back-pressure.. ... View more

I posted an edit to clarify what i have found so far. Sorry for not doing this earlier. Depending on how old your forwarder was before upgrade, remember that the direct upgrade to forwarder 9+ is only supported from 8.1.x and higher.  That said it I don't think we have seen the end of this yet 😞 ... View more

Holy Cow! Per that document, I tried enabling: mc_auto_config = enabled ...and it removed all my indexers from the cluster. Good times. I think I'll just learn to live without those volume dashboards, wouldn't be the first time I had to ignore missing functionality. Pro tip:  don't bother taking the advanced troubleshooting class at Splunk.conf -- didn't prepare me for anything useful... ... View more

did you ever get resolution on this? My deployment server stopped servicing clients -- start throwing this error. No firewall or selinux issues as suggested below... ... View more

When you are updating to 9.0.4+ or at least 9.0.5 this adding version string to dashboards/forms should be happening automatic. Some older version 9.0.4 etc. have some issues with some special tags etc. You could get more information from slack https://splunk-usergroups.slack.com/archives/C03M9ENE6AD ... View more

Thanks! That's it, for some reason that was commented out. # SPLUNK_HOME=C:\Program Files\SplunkUniversalForwarder ... View more

See my response in https://community.splunk.com/t5/Getting-Data-In/btool-quits-with-quot-SPLUNK-HOME-must-be-set-Stopping-quot/m-p/634938/highlight/true#M108654 ... View more

Yes, as simple as that.  ... View more

This has never worked for me (since version 4.0). I always assumed it was because we're on an isolated enclave (no Internet) regardless of the URL shown. Well, I'm on 9.0.0.1 now and it's still not working. Thought I'd try one more time... nope. I can't believe something so simple has *never* been fixed by Splunk. Going back to giving up on it again. ... View more

Thanks! I also discovered that the brute force technique works too: rm -rf ../var/lib/splunk/fishbucket Not as elegante, but effective... ... View more

hi @mykol_j. I'm sorry! In Italy we say "messenger brings no pain"! Anyway, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

I would give all my karma to anyone that could explain this to me... I keep getting pointed to docs that read like Latin to me, making no sense in practical terms. I'm a security/intell analysts, not a data-scientist; been using Splunk for over 8 years with a couple of certs under my belt, and have seen tons of KV store errors in my logs since they introduced them -- and mongod.log doesn't ever mention it (or help)... My Karma-Kingdom for a (good, pragmatic) explanation! ... View more

Me too... almost every one of my Universal Forwarder clients, and yet, it's running and sending in logs... ... View more

forgive my ignorance, but I don't understand the answer. Do I look on my indexers (all 3 in my case) for this? What am I looking for? ... View more

Great suggestion on using btool... However, it confirmed that all is good. I'm focusing on [WinHostMon://Disk] for my test case. I definitely have: [WinHostMon://Disk] interval = 86400 disabled = 0 type = Disk And definitely confirmed my system is showing data for my Name="C:" at exactly 2 hour intervals... but once in a while only waits an hour in between. Go figure. ... View more