Also, please edit your existing question instead of posting a new answer. ... View more

Should the splunk forwarder license have the same expiration date as that of the indexer from where the splunk-forwarder-license is copied or it doesnt matter ? ... View more

I've had the same problem. I can filter perfmon this way. I have a mix of heavy/universal forwarders and don't want to implement the filter on every windows heavy forwarder individually. ... View more

Thx Ed.Still the same issue persist... tried enable boot-start and it ended with the following msg: ... pywintypes.com_error: (-2147023838, 'The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.', None, None) Regarding permissions,domain admin has the highest privileges thus shouldn't be an issue? ... View more

adding DATETIME_CONFIG = current in props.conf solves it.. ... View more

This works for pre-4.2 installations, but with 4.2 and license pooling the license_audit.log file always reports 0 for all the fields. How would you structure the search on a 4.2.X system that is configured for license pooling? ... View more

Have you configured a network input listening on port 514 on the Splunk side? By default the app is configured for the following inputs: [tcp://9998] sourcetype = asm_log [monitor:///home/sheyda/SplunkData/asm_full_dos] disabled = 1 host = sheyda-laptop host_regex = host_segment = index = default sourcetype = asm_log [monitor:///home/sheyda/SplunkData/dos_log] disabled = 1 host = sheyda-laptop host_regex = host_segment = index = default sourcetype = as [monitor:///home/sheyda/SplunkData/psm_splunk] disabled = 1 host = sheyda-laptop host_regex = host_segment = index = default sourcetype = psm_log [monitor:///var/log] disabled = 1 host = sheyda-laptop host_regex = host_segment = index = default sourcetype = [tcp://9997] sourcetype = psm_log Most of these seem to be very specific to where the application creator was storing their logs. If you're only going to be sending over Firepass logs using 514/UDP then you could configure inputs.conf like this: [udp://514] sourcetype = firepass_log ... View more

another query posted and another that doesnt work.. for me anyway. ... View more

Is this still valid? I have no [manager/data...... in that file at all. I do see the individual inputs that I would like my restricted user to have access to.. In my case they are website availability check (web_ping) inputs. I want certain users to be able to add or remove these checks. Can't find a particular capability to add to give view of the checks and ability to edit and do not see corresponding entries to what this article suggests 5 years ago... ... View more

No idea how to solve it..not able to restart production server now probably has to schedule it. Anyway, the suggestions are useful in troubleshooting installation issues as well. ... View more

Apro, Here is another answer that should help http://answers.splunk.com/questions/2291/how-to-backup-restore-splunk-db-to-new-system ... View more