Thanks, console access is not an issue, so the scripted input suggestion does not help here 😉 So the challenge would be to convert the provided PowerSell script to a standard batch file: http://download.splunk.com/products/certificates/renewcerts-2016-05-05.zip ... View more

Actually this issue was also clarified in this question: http://answers.splunk.com/answers/26571/unable-to-search-for-extracted-substring-if-didnt-startend-with-word-boundary-in-the-string-it-was-extracted-from ... View more

Well, I figured the problem and it was actually related to an field extraction that was used as the input field to the problematic lookup. That field is extracted from a very long string in the raw data where only the first 800 chars are used, like this: OriginalField:\s(?P .{800}) After extraction, this field is used for the lookup (and it works) but the actual field does not work for direct filtering results index=A OriginalField=OriginalValue That's because Splunk considers the "longer string" as the full value of the field and only returns results using index=A OriginalField=OriginalValue* SO, when using the field from the Automatic Lookup, using Job Inspection I saw that Splunk "under the covers" is actually doing this: index=A LookupFiled=value ===> index=A OriginalField=OriginalValue AND LookupField=value And that's why it produces no results 😞 The solution was to add a * to the end of lookup value in the Lookup Table and create a Calculated Field with the * to use as the lookup input 😉 Hope this can help somone 😉 ... View more

Thanks, that info was not present in the documentation for v6.0 but $click.name2$ worked 😉 Still not sure how to use the series attribute in the link tag but, for now the issue is solved! ... View more

Ok, I just found the problem. The copy of the user folders from the Indexer to the Search head resulted in invalid folder ownership and permissions on the Search Head. So, not even the admin could see the objects. Actually, users were not even able to save new searches but that had not been reported until now. The issue was happening in MOST of the folders, but not all, that's why some objects were being listed. Then, somehow the Window Server was not allowing Ownership changing (folders had "unknown user") so we had to re-copy everything again but this time it worked 😉 ... View more

this did not work for me... does Splunk need to be restarted ? ... View more

I have the same problem! How do you detected the corrupted index ? ... View more

I also have this problem. Funny that it happens in Chrome and IE8 with some users/machines. But on IE8 it works with other machines/clients ... View more

Our problems seem to be performance related since we are using a network storage for the index. After a little help from Splunk Support we found a few messages indicating the queues were blocked probably because of network performance issues. The message is "Stopping all listening ports. Queues blocked for more than 300 seconds". We are still testing everything to make sure that's the correct diagnose. If we find something I will post here ! ... View more

Thanks. We run a scheduled search to monitor if data is not being received from the forwarders and caputres the most recent time entry (when the data stopped) I was able to see that, at that time, all the forwarders were reporting Connection Failed (on TcpOutputProc) It seems to be a problem at the receiving index... The indexer is still running but TCP data is just not allowed to pass (although UDP and local monitoring works) Maybe it's some kind of firewall issue, any ideia on how to diagnose this further ? ... View more