Afternoon, I've been beating my head against the keyboard the last few days trying to get this to work. I want to exclude these two event codes from being indexed. This is what my inputs.conf file looks like: [default] host = "hostname" [splunktcp://9997] connection_host = ip [WinEventLog://Security] disabled=0 current_only=1 blacklist=5447,6417 I save the file, restart splunk from Settings -> Server Controls -> Restart Splunk. Wait about 30 minutes or so to see if the event codes are being dropped from my index. No Joy.  I've tried adding in sourcetype=WinEventLog:Security, changing the blacklist#, tried using this [WinEventLog://Security] disabled=0 current_only=1 blacklist1= EventCode ="5447" Message="A Windows Filtering Platform filter has changed*" Still no joy.   ... View more

In the process of upgrading our splunk enterprise. Currently on version 7.1.3 (I know, super old, bear with me). Installed the Splunk Platform Readiness App v.2.2.1, set the permissions to write as the documentation states. Go to launch the app and I get this error:  Error reading progress for user: <me> on host <hostname>   Dig a bit more into it and realize that the Splunk Platform Readiness App uses the KV store. Run into these errors: KV Store process terminated abnormally (exit code 14, status exited with code 14) See mongod.log and splunkd.log for details KV Store changed status to failed. KV Store process terminated. Failed to start KV Store process. See mongod.log and splunkd.log for details. *******Splunk is running on Windows Server******* I tried renaming the server.pem file in Splunk/etc/auth and restarting - it made a new server.pem file, same issues persist. Attempted to look into the mongod.log and splunkd.log but I'm not sure what I should be looking for.  Haven't yet tried to rename the mongo folder in /vat/lib/splunk/kvstore to mongo(old), as I saw that it worked for some other people with the same issue.     Did some more troubleshooting: renamed the mongo folder to mongo(old) and it recreated a new one. Same issues as before. Looked in the mongod.log file and found this: Detected unclean shutdown - C:\Program Files\Splunk\var\lib\kvstore\mongo\mongod.lock is not empty. InFile::open(), CreateFileW for C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\journal\lsn failed with Access is denied. ... View more