How is that relevant to the question? ... View more

Pls check if the connectivity from search head to indexer works [ by ping or telnet ip mgmt. port]. If there is a connectivity/network issue, we still get the same error. [ I assume you are entering correct admin password when configuring them] ... View more

each indexer has a $SPLUNK_HOME/etc/auth/distServerKeys/{SEARCH_HEAD}/trusted.pem for each search head and the cluster master. If for whatever reason your indexer "knew" of your search head in the past, and you've recently rebuilt your search head or created a clone with the same servername, etc. then you may have to delete the {SEARCH_HEAD} dir show above on each indexer that previously knew of the search head. Then, add the peer again via the UI on the search head. It happened to us when we changed from single search head to search head cluster, and we re-used the old search head in the new SHC. ... View more

Yes, if the serverclass.conf is configured and the repository has the required app, it should be loaded. Ensure you are loading the required server class and that connectivity from the deployment client to server exists. If you still have issues, paste the contents/errors from splunkd.logs in the deployment client ... View more

We expect to put out a new version including this fix in the next few weeks. ... View more

It's been a long time and I honestly don't recall anymore 😞 Give it a shot and see? Let us know what you find out? ... View more

Depending on how unique your messages are, you could always try ...| stats count last(source) AS dup_file by _raw | search count > 1 | table dup_file if you get any results, you will likely have indexed the same event/file more than once. The results will be rather simplistic, but...it might help. _raw is the whole event, including its timestamp, which should be fairly unique in combination with the rest of the event text. Please not that it may take some time, since splunk will have to go through all events. Some further qualification (sourcetype, host etc) may be necessary to speed things up. /k ... View more

The pipe was missed when I posted the query, however it's present in my config spec. Any other possibilities? Also, does splunk not allow to 2 or more stanza with the same monitor line, eg. monitor::/var/log monitor::/var/log with different files in the whitelist? ... View more

Thanks MuS. I can change the monitor stanza to look at the directory and change the whitelist to allow it. I'll test that out. The reason i had them separately, was there a lot of files on that directory, i wanted them get handful of them to a given sourcetype and others to another... ( possibily this could also be controlled via whitelist) ... View more

i think this response is much more complete and accurate: https://answers.splunk.com/answers/103900/is-there-a-walk-through-on-how-to-deploy-authentication-conf.html ... View more

Are these drives that "need user authentication" mapped as network drives? If so, then you need to install Splunk as a user that already has at least read access to those volumes/drives. Splunk can only authenticate with the username and password that you give it at installation. More info here: http://docs.splunk.com/Documentation/Splunk/latest/Installation/InstallonWindows#Choose_the_user_Splunk_should_run_as http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindowsdata ... View more

This docs section covers how Splunk handles rotated files. Essentially, when you initially add a directory for monitoring Splunk will read all of the files in there because it hasn't seen any of them before, but after that it will never re-index a rotated file because the contents will be the same as before. http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled ... View more

yes, we do receive syslogs over udp. however, all our splunk nodes are within green side and hence i guess intra splunk nodes communication are http over tcp and some may be https over tcp. ... View more

Hello. i had the same problem, but this solution didn't work. ami missing something? how about the index? ... View more

Agree with jbsplunk. the forwarder can run on a port other than 8089. However, it should be able to connect to deployment server on the mgmt port and for making things simpler, the mgmt of deployment server should be same as that of the other splunk nodes (search heads and indexers) ... View more