That's not how it works. I don't know this particular solution but I'm assuming it's trying to connect to some Dynatrace API endpoint to retrieve data. For this it has to verify its certificate. Not yours. You don't use your Splunk certificate here nor you use the certificate of the CA that issued your Splunk's certificate. For the verification to work you must trust the RootCA which is in the root of the certification path of the server providing the Dynatrace API. ... View more

Hi here is some old answers about this: https://community.splunk.com/t5/Installation/Upgrading-and-migrating-to-a-new-host-how-to-migrate-large/m-p/601048#M11615 https://community.splunk.com/t5/Splunk-Enterprise/Migration-of-Splunk-to-different-server-same-platform-Linux-but/m-p/538069#M4823 https://community.splunk.com/t5/Installation/What-are-the-steps-for-Splunk-enterprise-migration-physical-to/m-p/648565/highlight/true when something goes wrong. r. Ismo ... View more

The section of the troubleshooting guide your refer to is wrong in fixing this app's issue with respect to the certificates.  That section refers to splunk server side authentication not the app.  ... View more

We got the same error for all the members of the cluster.  When it occurred, we had to restart Splunk on each member.  ... View more

Write a script to rebuild the files. ... View more

Please read the complete config information: disableDefaultPort = <boolean> * If set to "true", turns off listening on the splunkd management port, which is 8089 by default. * On Universal Forwarders, when this value is "true" the value set for mgmtHostPort in web.conf will be ignored. Similarly, when set to "false", the value set for mgmtHostPort in web.conf will be used for binding management port. * NOTE: On Universal Forwarders, to reduce the risk of exploitation Splunk recommends the management port is disabled and local CLI is not used. If the management port is enabled, a valid TLS certification should be installed and the port should be bound to localhost. * NOTE: Changing this setting is not recommended on other Splunk instances. * This is the general communication path to splunkd. If it is disabled, there is no way to communicate with a running splunk instance. * This means many command line splunk invocations cannot function, Splunk Web cannot function, the REST interface cannot function, etc. * If you choose to disable the port anyway, understand that you are selecting reduced Splunk functionality. * Default: false ... View more

Hi @Azeemering thanks for your repsonse, about the crating my own app to parse the fields part...I'm not familiar with the props.conf & transforms.conf files. Any help you can give? ... View more

There is varying info about this but remember - if digging up old threads - that moving to frozen used to be done by external script, now it's done internally by splunkd if I remember correctly. Anyway, it will probably depend on what you mean by "storage is not available" and how it presents itself within OS and splunk. For Splunk the database directories are just that - directory paths. It's up to OS to make sure there is something "down there" to write into. So - for example - if you have an archive mount point which wasn't mounted, splunk should happily write to the directory on the main filesystem, not waiting for the mount to happen. I'm not sure how splunk would handle situation when the storage had been mounted but "went away" due to power problems, network outage, whatever. From the OS point of view that could result in a timeout on attempts to access the directory. I'm not sure how splunkd would handle that. So the answer is not that straightforward. ... View more

Firstly, let me point out that you're digging up a very old thread. You'd get better chance of reasonable (i.e. not mine ;)) answer if you created a new question and optionally provided a link to the old one for reference. But to the point. I suppose there are several scenarios that can happen during an attempt to roll and accounting for all of them and handling them could be: 1) hard to do 2) not necessarily desired in some situations. Imagine a cluster with RF=1. If you stop rolling buckets you're on the best path to filling up the storage and rendering the indexer inoperable. But if you can find a good use case for some particular behaviour that could be implemented in the maintenance thread, feel free to open an idea with https://ideas.splunk.com/ ... View more

Assuming you have _time as the timestamp for the events, you can run a scheduled report over the last hour, say every 5 minutes and alert if you get any results ... your index | spath Operation | spath UserId | eval timeadded=if(Operation="MemberAdded",_time,null()) | eval timeremoved=if(Operation="MemberRemoved",_time,null()) | stats values(timeadded) as timeadded values(timeremoved) as timeremoved by UserId | where isnotnull(timeadded) AND isnotnull(timeremoved) and timeadded <= timeremoved ... View more