Hi all, Splunk Enterprise 6.2.3 (264376). Overnight, the indexer stopped receiving data from all of the forwarders. Up until that point, it was receiving data from them all fine without issues. The splunkd.log on the forwarders shows the following error: 05-26-2016 09:48:15.956 +1000 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected 05-26-2016 09:48:22.644 +1000 ERROR TcpOutputFd - Connection to host=externalip:9996 failed. sock_error = 0. SSL Error = error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 05-26-2016 09:48:22.644 +1000 WARN TcpOutputProc - Applying quarantine to idx=externalip:9996 numberOfFailures=2 In the excerpt above I have replaced my external IP with externalip. We hadn't made any configuration changes before the issue occurred, but once it happened and I saw the error, I went ahead and replaced the default expiring certificates as per the recent email thinking this may have been the problem and restarted, but the issue is still happening. I have tried updating the outputs.conf file on a forwarder to say sslVerifyServerCert = false but this didn't help, still got the same error. I inherited this Splunk install when a colleague left a few months ago so I am still learning having never used Splunk before that, haven't been able to figure out what to try next. Any assistance from someone would be great. Regards, William ... View more

Hello, I have a search which I run for monitoring memory usage across different platforms. This has been working well for me for quite some time, however, I have recently added Windows Server 2012 machines to my environment, and, due to memory combining, my search does not work properly for those machines. I would like to exclude these machines from the search in a simple way, e.g., by adding a search term like host_os_name!="windows_server_2012*", but have thus far been unable to find if / where splunk logs information about the host beyond just the platform. Can anyone recommend a straightforward method for gathering this information? Thanks. ... View more