Hi, Following the root certificate expiration explained at: https://answers.splunk.com/answers/395886/for-splunk-enterprise-splunk-light-and-hunk-pre-63.html?elqTrackId=4f5861c90f7f4a75b297cee5d33506ec&elq=e309d0c8f1384115a2e523a45004dd5b&elqaid=7582&elqat=1&elqCampaignId= Is there a way to update root certificates on a Splunk 4.2 Forwarder running on a "legacy" Windows 2000 server without PowerShell support? Thanks ... View more

I have an automatic lookup that works ok but when I try to filter results by selecting a field that comes from the lookup table, it only works using a piped search command, like this index=A lookupfield=value (does not work) index=A | search lookupfield=value (works!) I have other similar lookups (other index, other CSV file, but similar configurations) that work with both searches...the advantage of the "direct" filtering is the use of the drilldown on the fields of the side bar. Anyway, I feel something is wrong if both lookups have different behaviours. What can be wrong with this ? ... View more

Hi, I have Splunk for PaloAltoNetworks App installed on a Splunk system with one Indexer and one Search Head. The indexer is where the PaloAlto App is configured to receive and index the events. The search head is where the App should be used by the users. To use DataModel acceleration, this should be configured in the Search Head. Right now, we have the acceleration turned on in the SearchHead but it's in the indexer (on the tstatsHomePath) that the cache is being written. Dashboards on both servers work but I think they are not using the accelerated data. How can I check where the accelerated data from the Data Model is being written ? ... View more

We have migrated from a single Indexer system to a Search Head + Indexer. All apps and users were copied to the Search Head. Authentication is LDAP. Users on the search head do not see their own private objects (searches, extractions, etc.) although that information is present in the user's folder .conf files. Global and App level objects are shared and accessible. From the documentation, I can't find any process to "refresh" or "rebuild" the knowledge of Splunk of there private objects (which I believe don't even need stanzas in the user's local.meta file). Nevertheless, everything was transfered from the original indexer. In the old indexer, where all the objects still remain, it's possible (even with the admin) to see all the user's private objects. ... View more

I'm going from a single server installation to a Search Head + Indexer setup. I've managed to install and setup the Search Head but now I would like to migrate everything (except the indexes) to the search head, that is: Users, Roles and Authentication config Apps, Searches, Reports and Views Macros, Extracted Fields and Lookups Basically, the only thing that stays in the original server is the actual indexes (and indexes.conf of course) since the plan is to have users use JUST the Search Head. All the documentation talks about is the knowledge bundle but, at this moment, all the "knowledge" is in the indexer... It seems that I should copy (almost) the entire(?) $SPLUNK_HOME/etc to the search head but I can't find anything on the documentation about this. ... View more

Following this question: http://splunk-base.splunk.com/answers/4863/setting-up-sso-on-windows I was able to get SSO working on W2K8/IIS7 with Ionics ISAPI Filter. Proxy is setup at localhost (port 80) and redirects to the server on 8000 (using the name, not localhost) Everyhing looks good, SSO debug page shows Remote-User header being received correctly. Splunk is using LDAP authentication (over Active Directory). SSO is using permissive mode so allow users to still access splunk at http://server:8000 and login with their existing LDAP username. Role is mapped using the LDAP group mapping and it's working fine. The problem is, when a user accesses through the proxy, Splunk does not show any data (searches return empty, summary dashboard also empty) as if the user did not have any roles assigned. However, the user can access the Manager and, if it has a admin role, it can do anything there... But all the searches and dashboards do not work... It appears to be the same problem desccribed in: http://splunk-base.splunk.com/answers/42223/sso-broken-after-upgrade-to-431 ... View more