Thank-you! Does that mean if I set '* hard maxlogins 10', splunk will operate correctly? ... View more

What URL provides this App? ... View more

It ends up that in the local/savedsearches.conf you have to also add disabled=1 also ... View more

So [Bucket Copy Trigger] actually calls archivebuckets, which calls copybuckets.  The archiving was leading me to question if the functionality is necessary because buckets do get moved from hot, warm, cold, archive. In any splunk install (head or indexer) I just need to do the following: 1.  copy  $SPLUNK_HOME/etc/apps/splunk_archiver/default/savedsearches.conf to $SPLUNK_HOME/etc/aps/splunk_archiver/local/savedsearches.conf 2. Update local/savedsearches.conf so under [Bucket Copy Trigger]      change enableSched = 1 to  enableSched = 0 Anything else? ... View more

Isn't the bucket copy functionality necessary in Splunk? ... View more

Solution with Java HttpsURLConnection and insecure (same as -k option of curl): import java.io.BufferedReader; import java.io.InputStream; import java.io.InputStreamReader; import java.io.OutputStream; import java.net.URL; import java.util.Arrays; import java.util.Base64; import java.util.HashMap; import java.util.List; import javax.net.ssl.HostnameVerifier; import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSession; import javax.net.ssl.TrustManager; import javax.net.ssl.X509TrustManager; public class TstSplunkHttpUrl { private static final String USER = "admin"; private static final String PASSWORD = "password"; private static final String USER_PASS = USER + ":" + PASSWORD; private static final String SPLUNK_HEAD_IP = "1.2.3.4"; private static final String SPLUNK_HEAD_PORT = "8089"; private static final String SPLUNK_SEARCH_URL = "https://" + SPLUNK_HEAD_IP + ":" + SPLUNK_HEAD_PORT + "/services/search/jobs/export"; private static final String PARAM_SPLUNK_SEARCH_CMD = "search=|inputlookup hosts-info"; private static final String PARAM_SPLUNK_SEARCH_OUTPUT_TYPE = "output_mode=csv"; private static final String PARAMS_SPLUNK_SEARCH = PARAM_SPLUNK_SEARCH_CMD + "&" + PARAM_SPLUNK_SEARCH_OUTPUT_TYPE; public static void main(String[] args) {      try      {           // Create a trust manager that does not validate trust certificate chains           TrustManager[] trustAllCerts = new TrustManager[]{                new X509TrustManager()                {                      @Override                      public java.security.cert.X509Certificate[] getAcceptedIssuers()                      {                           return null;                      }                      @Override                      public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType)                      {                      }             @Override             public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType)             {             }       } };                  // Install the all-trusting trust manager                  SSLContext sc = SSLContext.getInstance("SSL");                  sc.init(null, trustAllCerts, new java.security.SecureRandom());                  HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());                  // Create all-trusting host name verifier                  HostnameVerifier allHostsValid = new HostnameVerifier()                  {                        @Override                        public boolean verify(String hostname, SSLSession session) {                             return true;                        }                  };                  // Install the all-trusting host verifier                  HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);                  // Encode User Password                  String encodedUserPass = new String(Base64.getEncoder().encode(USER_PASS.getBytes()));                  String basicAuth = "Basic " + encodedUserPass;                  // Setup and open URL Connection                  URL url = new URL(SPLUNK_SEARCH_URL);                  HttpsURLConnection urlConn = (HttpsURLConnection) url.openConnection();                  // Setup POST connection                  urlConn.setRequestMethod("POST");                  // Setup authorization to URL                  urlConn.setRequestProperty("Authorization", basicAuth);                  // Send parameters                  urlConn.setDoOutput(true);                  OutputStream outStream = urlConn.getOutputStream();                  outStream.write(PARAMS_SPLUNK_SEARCH.getBytes());                  outStream.flush();                  outStream.close();                    //Get connection response code                  int urlConnRspCode = urlConn.getResponseCode();                  if (urlConnRspCode == HttpsURLConnection.HTTP_OK)                 {                      System.out.println("INFO: URL Connection Response Code = " + urlConnRspCode + "; OK");                      InputStream resultStream = urlConn.getInputStream();                      InputStreamReader resultStreamReader = new InputStreamReader(resultStream);                      BufferedReader resultBufferedReader = new BufferedReader(resultStreamReader);                      String line;                      String splitBy = ",";                      int index=0;                      while ((line = resultBufferedReader.readLine()) != null)                      {                           String[] record = line.split(splitBy);                           index++;                           System.out.println("Line #" + index + ":" + Arrays.toString(record));                      }                }                else                {                     System.out.println("INFO: URL Connection Response Code = " + urlConnRspCode + "; NOT OK");                }           }          catch (Exception e)          {               e.printStackTrace();          }      } } ... View more

Did you figure this out?  if so, what did you do? ... View more

I'm seeing a similar problem.  The file hashes are the same but the 'stat <file>' shows the metadata has changed.  Splunk seems to also re-read a file if the metadata has changed. Did you get a resolution? ... View more

A distributed environment with 1 splunk head and 1 splunk indexer.  The head is configured to be the License master.   It is a Splunk Enterprise with a license. ... View more

Thank-you Anil for responding. I was ingesting too many files and the indexing/ingesting was taking a lot of time.  I was looking at the output of 'splunk list inputstatus'  https://localhost:8089/services/admin/inputstatus to see what the status of the indexing was:  the file position showed as 0 and status as File was read.  So, it wasn't conclusive as to what was happening.  ... View more