Currently, I have enabled splunk forwarder on a particular windows box with SSL encryption to the indexer. ( Although this may not be actually the source of the issue) I am receiving events for unconfigured/disabled index='_audit' on the forwader for some reason. I did verify that all the indexes in the forwarder are enabled, and the same holds true for the receiver Any idea what could be the source of the issue? ... View more

I recently copied the splunk-forwarder.license details mentioned in our indexer to splunk.license (into one of our forwarders), but for some reason the expiry for splunk-forwarder license shows 30 days where as our enterprise license validation is upto Sept 5,2284 Would this automatically refresh? or is there something wrong in my steps Thanks Raghu ... View more

Hey Team, I created a custom app to enable charting, and tried setting up an insecure login feature ( inorder to embed the charts in a webpage), for some reason it is throwing me a 403 forbidden. Our splunk server is configured with LDAP configuration, was just wondering if its possible to change the authentication mode for that particular APP alone? or am I going wrong somewhere? the embed string I am trying to use is http://splunk:8000/en_US/account/insecurelogin?username=admin&password=changeme&return_to=/app/TEST/sample_dashboard Thanks once again - Raghu ... View more

We received 4 alerts of License violations and the last message was around July 1, 2010. For somereason the messages havent cleared yet. Does it persist for a 30 day period for multiple license violations ( < 5) ... View more