I have read other forums and posts, but it did not help with my issue.  I am getting the typical Error while creating deployable apps: Error coping src'" /opt/splunk/etc/shcluster/my_app" to staging area=" /opt/splunk/var/run/splunk/deply.#######.tmp/apps/my_app." 180 errors    They are all python files (.py) this is for every app that has python files as well. I have checked the permissions and Splunk owns the files. I am so confused as to what is happening. I understand this is a permission issue, but Splunk owns the files (rambling) with permissions set to rw on all python files on the deployer.  Also, splunk user owns all files under /opt/splunk    Any help greatly appreciated!  ... View more

Good morning,  Getting a weird error this morning when trying to run searches. It is saying that m license is expired, or I have exceeded your license limits too many times.    1. I have a valid Enterprise License at about 750GB a day 2. Within the license manager all is well. No violations, valid license, etc.  3. Peers are associated to the license group (750GB is what I allocated for it)  4. Everything looks green with no messages    Not sure what is causing this issue but sometimes search will work and sometimes it wont. However, it  will always throw the litsearch error.  ... View more

Good morning,  So I am trying to monitor all files within this directory /var/log/syslog/<IP> Directory structure: /var/log/syslog/<IP>/2024/01 | 02 | 03 | 04 | 05 | 06 | 07/secure | cron | messages Hope this makes sense there are multiple subdirectories, the end goal is to monitor secure, cron, and messages I wrote this stanza within inputs.conf and the configuration did take on the Universal Forwarder [monitor:///var/log/syslog/192.168.1.1/.../secure] disabled = false host_segment = 4 index = insght [monitor:///var/log/syslog/192.168.1.1/.../cron] disabled = false host_segment = 4 index = insght [monitor:///var/log/syslog/192.168.1.1/.../messages] disabled = false host_segment = 4 index = insght   I have also tried this to capture all subdirs/files [monitor:///var/log/syslog/192.168.1.1] disabled = false host_segment = 4 recursive = true index = insght   Also within _internal I get this message:  INFO TaillingProcess [#### MainTailingThread] - Parsing configuration stanza: monitor:///var/log/syslog/<IP>   Which seems to hang there with no other messages logged for the particular stanza(s)   IP Address used is notional, thanks for the help!  ... View more

Good morning,     I recently created a tag for a set of hosts. For example, CA for all California hosts. Does this take time to populate or show up within my Data Models?  I am running a search similar to this  | tstats count FROM datamodel=<data_model>.<root_event> WHERE tag=CA BY _time, host, etc....   I have also tried this  | datamodel  <data_model> <root_event> search  | search tag=CA | table _time, host, etc.... ... View more