About flakshack

flakshack · ‎03-05-2021

Thanks for the reply. All of my systems are located in the same time zone (GMT-5) and I have that set in my user preferences in the Splunk UI. Per your suggestion, I tried setting the time zone for the sourcetype (via the UI) to +5 and also later to -5. Weirdly, neither setting made any difference in the _time of the log entries in Splunk. In both cases, the time still showed up in the future. So I decided to change the timestamp format to exclude the -05:00 and also change the time zone and that worked. Timestamp format: %Y-%m-%dT%H:%M:%S Time Zone: GMT Thanks for the help!

flakshack · ‎02-26-2021

I just configured a new device to send data to a syslog server (w/universal forwarder), but when it shows up in Splunk, the time is incorrect. I have about 30 other devices from different vendors in the same configuration that are working fine. Here's an example syslog entry: 2021-02-26T15:35:09-05:00 XYZ -- -Office-HQ edge [ 9076 ] : EDGE_NEW_DEVICE: New or updated client device b4:56:e3:a8:91:b5 , ip 10.5.38.0 When this log entry shows up in Splunk, the _time is 3:35:09 PM (future) when it should be 10:35:09 AM. The Splunk server (single-node) and device are both in the same time zone with me and other devices on the same syslog server are working fine. I've reviewed the following posts, but haven't had much luck How time zones are processed by Splunk Configure timestamp recognition props.conf documentation For example, I set the sourcetype to "velocloud:syslog" for the input and I tried editing the sourcetype so that the TIME_FORMAT=%Y-%m-%dT%H:%M:%S%:z Unfortunately, this hasn't had any effect. I feel like I'm missing something simple, but I've now spent hours going through everything twice with no luck. Any help would be appreciated.

flakshack · ‎11-07-2018

I got this error message and thought I would post my solution here in case it helps someone else. It turns out that I had this problem, even when using an account I had configured as sysadmin on the server. For example, I could connect to the SQL server with SQL Server Management Studio with this account and could see the database and all the tables. However, when I connected with the same account in DB Connect\SQL Explorer, it would show all of the databases in the Catalog combo box, but I would get an error message for the Schema combo box, "Cannot get schemas." I turned on DB Connect logging and would see the following error in the log file: ERROR c.s.d.s.a.s.d.impl.DatabaseMetadataServiceImpl - Unable to get schemas metadata com.microsoft.sqlserver.jdbc.SQLServerException: Invalid object name '[my_database].sys.schemas'. I turned out that this problem was because I was using the MS SQL Server JDBC driver version 7. When setting it up, I figured I would ignore Splunk's guidance to use version 4.1 or 4.2 and use the latest available version. Turns out this was a bad idea. In my testing if I copy the version 4.2 driver into the folder and restart, everything works great. Then if I copy the version 7 driver into the folder and restart, I get this error message (without any changes to permissions or anything). Anyway, hope this helps someone.

flakshack · ‎09-18-2018

This was exactly my problem. Thanks for posting!

flakshack · ‎03-29-2012

Thanks, should've found that one myself.

flakshack · ‎03-29-2012

We just switched from the trial license to a free license. Whenever I browse to the main Splunk web page, I see the login page briefly, then (via javascript) it changes to a "Checking for Updates" page, followed by a "No Updates Found" page, followed by a Welcome to Splunk Free page. When I click on the Continue button, I'm presented with the main dashboard, logged in as Administrator. I never actually enter any credentials into a login page, it just automatically logs anyone who goes to the website as Administrator. I've tested deleting all the browser's cookies and settings, using different browsers and even using different computers with no change. If it makes any difference, previously we had Splunk setup with LDAP/AD authentication. Any tips would be appreciated.

flakshack · ‎03-29-2012

"splunk clean eventdata all" worked for me after going from trial to free license.

Posts	7
Solutions	0
Karma Given	14
Karma Received	5
Member Since	‎11-29-2011

Online Status	Offline
Date Last Visited	‎03-05-2021 11:22 AM

Why isn't my TIME_FORMAT working for this syslog d...

Splunk logs in as Admin without asking for passwor...

Re: Why isn't my TIME_FORMAT working for this sysl...

Why isn't my TIME_FORMAT working for this syslog d...

Re: Splunk DB Connect: Why am I getting error "no ...

Re: Your entry was not saved. The following error ...

Re: Splunk logs in as Admin without asking for pas...

Splunk logs in as Admin without asking for passwor...

Re: Slaves in violation with trial-license, how to...