Dears, We are running the following versions of Splunk and supporting apps for Windows infrastructure: Splunk Enterprise: 7.2.3 Splunk App for Windows Infrastructure(splunk_app_windows_infrastructure): 1.5.1 Splunk Add-on for Microsoft Windows(Splunk_TA_windows): 4.8.4 Splunk Add-on for Microsoft Windows DNS(Splunk_TA_microsoft_dns): 1.0.1 Splunk Add-on for Microsoft Active Directory(Splunk_TA_microsoft_ad): 1.0.0 Splunk Supporting Add-on for Active Directory(SA-ldapsearch): 2.2.0 Splunk Add-on for PowerShell(SA-ModularInput-PowerShell): 1.2.1 Rhel OS: 7.3 The Splunk App for Windows Infrastructure does not Show me any User, Computer, or Group entry. Also the Guided Setup says "users not found", "Computers not found" and "Groups not found" All Dashboards related to them don't display any thing On the Windows AD Domain Controller the following apps are installed: Splunk App for Windows Infrastructure(splunk_app_windows_infrastructure): 1.5.1 Splunk Add-on for Microsoft Windows(Splunk_TA_windows): 4.8.4 Splunk Add-on for Microsoft Windows DNS(Splunk_TA_microsoft_dns): 1.0.1 Splunk Add-on for Microsoft Active Directory(Splunk_TA_microsoft_ad): 1.0.0 Splunk Add-on for PowerShell(SA-ModularInput-PowerShell): 1.2.1 sendtoindexer TA-DomainController-NT6 TA-DNSServer-NT6 please can someone help me to figure out why I can't get data? ... View more

Dears, i installed the Cisco Networks App for Splunk Enterprise and Cisco Networks Add-on (TA-cisco_ios) on both forwarder and indexer machines. also i'm successfully receive logs from cisco devices and all reports and dashboards are working fine except those who have the src_ip field as it doesn't appear in any search result while it's configured by default in the add-on and i see it when check the configured fields from settings ... View more

i have the frozen data archived in this path" /nfs-storage/frozen_path/cisco_asa/ " and when tried to restore it in splunk again i copied the bucket from this path to the thawed path using this command: [root@eib-siem cisco_asa]# cp -r db_1530576360_1530222901_40 /nfs-storage/thawed_path/cisco_asa/ and when tried to run the rebuild command give me the following output: [root@eib-siem cisco_asa]# splunk rebuild /nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40 -bash: splunk: command not found so i tried to run it as follow: [root@eib-siem ~]# cd /opt/splunk/bin/ [root@eib-siem bin]# ./splunk rebuild /nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40 USAGE: splunk rebuild [] [--ignore-read-error] [--no-log] Please see 'splunk fsck' for more options. This command is just a wrapper for 'splunk fsck'. Redirecting to 'splunkd fsck' with args: repair --one-bucket --include-hots --bucket-path=/nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40 --log-to--splunkd-log ERROR ProcessTracker - (subchild_43__RollFixMetadata) IndexConfig - Asked to check if idx= is an index with a remote storage, but that index does not exist on the system or is disabled INFO Fsck - (entire bucket) Rebuild for bucket='/nfs-storage/thawed_path/cisco_asa/db_1530576360_1530222901_40' took 149.3 seconds can anyone help me to solve this error????!!!!.... ... View more

I want to integrate EMC unity 500 storage with Splunk, to be able to see its logs on Splunk, so how can I do that? ... View more