please post the solution ... View more

With splunk Stopped please give me the output of netstat -aon|grep 8089 if this shows 8089 is established connection then you will need to disconnect what ever it is and start splunk with splunk user again shoudl fix the issue. ... View more

please how do i hashout as proposed by the solution   ... View more

As  I mentioned - problem was that we have an application on UF's and indexers for SSL log encryption. The problem was that  someone put in config file wrong password for .*pem file and because of that forwarders started to disappear from the console, as inactive. First thing what you should check - review both indexer and forwarder logs for any connection problems.   Best, Eugene ... View more

@ksing Thanks for sharing the script, it's running fine. But, still the Splunk Service is not running, please refer to the below output details. Additionally, am thinking that the existing version was not uninstalled properly/corrupted. Is there proper way to clean existing Splunk entries from the device? Thanks. Output: Status Name DisplayName ------ ---- ----------- Stopped SplunkForwarder SplunkForwarder Service SplunkForwarder service is Running on Copying necessary files for splunk ... stopping splunk service copying C:\splunk_install copy C:\splunk_install complete copying Copy-Item : Cannot bind argument to parameter 'Path' because it is null. At line:18 char:26 + Copy-Item -Recurse -Path $opappsrc -Destination $appPath -Force + ~~~~~~~~~ + CategoryInfo : InvalidData: (:) [Copy-Item], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.CopyItemCommand copy conmplete Start-Service : Service 'SplunkForwarder Service (SplunkForwarder)' cannot be started due to the following error: Cannot start service SplunkForwarder on computer '.'. At line:20 char:1 + Start-Service -Name SplunkForwarder + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommand Exception + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand Validating by checking if service is running. Get-Service : Cannot validate argument on parameter 'ComputerName'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again. At line:22 char:51 + Get-Service -Name "SplunkForwarder" -ComputerName $file -ErrorAction ... + ~~~~~ + CategoryInfo : InvalidData: (:) [Get-Service], ParameterBindingValidationException + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.GetServiceCommand SplunkForwarder service is Running on Complete ... View more

[+\-0-9#$%^!._?@]  character class  ... View more

there is no easy way of doing it but check the macros an app uses and then in that macro normally there is  a search which points to an index. settings-->advanced search-->search macros and there you can find the index being used by app. ... View more

# Import IIS module Import-Module WebAdministration # Get the list of Application Pools $appPools = Get-ChildItem IIS:\AppPools # Display the App Pool names and their statuses in key-value pairs foreach ($appPool in $appPools) { $status = Get-WebAppPoolState -Name $appPool.name Write-Output "appPoolName=$($appPool.name), appPoolStatus=$($status.Value)" }   You can expand with more details inf you like. You can run by either calling with powershell in your stanza or via cmd and call it with powershell that way. ... View more

Finally, it works! Thank you very much. ... View more

No problems with permissions, diskusage ++. I think it's a global problems. I know that for some days ago I tried to setup pkcs12 certificate (estreamer)  on splunk server.   But can't remember where I did these settings.  Out form commands:  $ source /home/splunk/bin/setSplunkEnv && df -H $SPLUNK_HOME $splunk_db Tab-completion of "splunk <verb> <object>" is available. Filesystem Size Used Avail Use% Mounted on /dev/mapper/centos-home 886G 587G 300G 67% /home $ $sudo /home/splunk/bin/splunk btool indexes list volume |egrep '(\[|path)' [volume:_splunk_summaries] path = $SPLUNK_DB $df Filesystem 1K-blocks Used Available Use% Mounted on /dev/mapper/centos-root 52403200 11477568 40925632 22% / devtmpfs 16312676 0 16312676 0% /dev tmpfs 16329816 0 16329816 0% /dev/shm tmpfs 16329816 10560 16319256 1% /run tmpfs 16329816 0 16329816 0% /sys/fs/cgroup /dev/sda3 1038336 173348 864988 17% /boot /dev/mapper/centos-home 865131800 558906488 306225312 65% /home tmpfs 3265964 12 3265952 1% /run/user/42 tmpfs 3265964 0 3265964 0% /run/user/1001 $   ... View more

The section of the troubleshooting guide your refer to is wrong in fixing this app's issue with respect to the certificates.  That section refers to splunk server side authentication not the app.  ... View more

Hi @Adpafer, if you can find a regex to identify one or both the data flows you can create two stanzas in all the configuration files. If you cannot, you could use the App I hinted before because it uses a search. Ciao. Giuseppe ... View more

FYI there are no index time field extractions on mode=multikv There are on mode=single but they are for metric store. ... View more

That's not possible in the way you are describing (afaik) ... View more

Datamodel Endpoint has data inside, but it seems that only from security logs not from sysmon. How can implement? ... View more

Thanks for your help!! ... View more

Quantum,  It will be great if you can accept one of the replies as answer. ... View more

That told what has defined, but it didn't told you what is current situation on your environment. There could be e.g. too less space for fulfil those definitions and/or some events could be there much longer as buckets contains newer events etc. Here is some older post which explain this behabiour https://community.splunk.com/t5/Getting-Data-In/What-counts-for-Splunk-retention-time-if-events-come-in-with-a/m-p/601655 https://community.splunk.com/t5/Splunk-Enterprise/Why-is-the-age-of-the-data-larger-than-the/m-p/548538/highlight/true https://community.splunk.com/t5/Splunk-Search/Why-am-I-still-seeing-old-data/m-p/605516 https://community.splunk.com/t5/Deployment-Architecture/Hot-Warm-Cold-bucket-sizing-How-do-I-set-up-my-index-conf-with/m-p/634369 ... View more

Hello SinghK, Could you please expand on your fix, i might be in the same senerio. Thank you. ... View more

We're not using LDAP, and these are local Splunk users. ... View more

Any update on this topic? I also have set mine higher and the max_size_kb remains at 500. ... View more

This one worked like a gem | rex "\"Message\":\"(?<Full_Message>[^\"]+)\",\"Details"     ... View more

So far what i can see is either there is a DB and we use DB connect app or the REST endpoint from which data can be collected.  There is not much info about his netsuite on internet so only guessing best possible solutions. ... View more

Hi @manojchacko78, if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the Contributors;-) ... View more