Hi all, So I am trying to specify a rest data input and I think there is a problem specifying a Header property which has a value with an "aring" (å) in it. I edited it into inputs.conf, but it was converted to an "a" when I saved the configuration back from Splunk Web. I had same problem with curl as well; I got it to work by adding the property to a file which was read by means of the -K switch. And it had to be an ANSI encoded file. I have the following configuration which should be ok I think: [rest://aName] auth_password = auth_type = none auth_user = backoff_time = 30 endpoint = https://aServer.a.dom.ain:8443/aProgram/system?_action=test host = idm http_method = POST index = idm index_error_response_codes = 1 polling_interval = 22 response_type = json sequential_mode = 0 sourcetype = json_no_timestamp streaming_request = 0 http_header_propertys = X-Username=aUserName,X-Password=N_XyZåAbC disabled = 0 Does anybody know a way to input this password (seemingly ANSI-encoded) with the awkward å (aring)? Unfortunately, changing the password is not an option. Thanks and regards, Bård Tørustad ... View more

Hi all, We have the following setup: Splunk Enterprise Server 6.4.1 Windows2008R2, 16 GB Physical Memory, 4 CPU Cores Mode: Standalone In all my searches from the Search-app i am getting a "yellow box with an exclamation mark in it", whereas in all the panels in a dashboard there is a "yellow triangle with an exclamation mark in it". In both cases the following text appears whene I click them: Eventtype 'wineventlog-dns' does not exist or is disabled. Eventtype 'wineventlog-ds' does not exist or is disabled. The searches as such seem to be ok. Any suggestions as to where I should start looking? Could it have anything to d with these mesaages from teh splunkd.log? At restart: 07-25-2016 18:01:17.613 +0200 INFO PipelineComponent - Pipeline structuredparsing disabled in default-mode.conf file 07-25-2016 18:01:17.691 +0200 INFO IntrospectionGenerator:resource_usage - RU_main - I-data gathering (Resource Usage) starting; period=10s 07-25-2016 18:01:18.038 +0200 WARN IntrospectionGenerator:resource_usage - RU - Failure executing initial system PDH query, status code is -2147481643 07-25-2016 18:01:18.038 +0200 WARN IntrospectionGenerator:resource_usage - RU - Failure executing initial disk PDH query, status code is -2147481643 07-25-2016 18:01:18.038 +0200 INFO IntrospectionGenerator:resource_usage - RU_main - I-data gathering (IO Statistics) starting; interval=60s 07-25-2016 18:01:18.038 +0200 WARN IntrospectionGenerator:resource_usage - RU - Failure executing PDH query, skipping getting iostats data this collection cycle. Status code is -2147481643 Therafter every minute this: 07-26-2016 02:15:32.082 +0200 WARN IntrospectionGenerator:resource_usage - RU - Failure executing PDH query, skipping getting iostats data this collection cycle. Status code is -2147481643 Thanks for any help, Kind reagards, Bård Tørustad ... View more

Hi all, I have started to test the "Monitoring of Java Virtual Machines with JMX"-application to monitor a Glassfish-instance. It seems to work fine; i get data from the java.lang-mbeans, but from the amx-mebean domain for JDBC connection pools I get nothing. This is perhaps not the correct place to ask this question; but I am only curious as to whether anyone of you has experienced the same? I am trying to retrieve attributes from this mbean: MBean Information Item Value MBean Name amx:type=jdbc-connection-pool-app-mon,pp=/mon/server-mon[server],name=resources/JobRepositoryConnectionPool/eAdmin-16.3.0.2 Properties in creation order pp=/mon/server-mon[server],type=jdbc-connection-pool-app-mon,name=resources/JobRepositoryConnectionPool/eAdmin-16.3.0.2 MBean domain amx type jdbc-connection-pool-app-mon pp /mon/server-mon[server] name resources/JobRepositoryConnectionPool/eAdmin-16.3.0.2 MBean Java Class jdbc-connection-pool-app-mon MBean Description JDBC Connection pool Application based Statistics with this template: <mbean domain="amx" properties="pp=/mon/server-mon[server],type=jdbc-connection-pool-mon,name=resources/JobRepositoryConnectionPool"> <attribute name="Name" outputname="navn"/> <attribute name="numconncreated" outputname="AntBrukt"/> </mbean> from which I get no events. From this template, however, I get what I want: <mbean domain="java.lang" properties="type=Compilation"> <!-- simple attributes --> <attribute name="TotalCompilationTime" outputname="TotalCompilationTime"/> </mbean> <mbean domain="java.lang" properties="type=ClassLoading"> <!-- simple attributes --> <attribute name="TotalLoadedClassCount" outputname="total"/> <attribute name="LoadedClassCount" outputname="current"/> <attribute name="UnloadedClassCount" outputname="unloaded"/> </mbean> ... Have any of you seen this before? We are on GlassFish Server Open Source Edition 4.1 (build 13) and java version "1.8.0_60" Java(TM) SE Runtime Environment (build 1.8.0_60-b27) Java HotSpot(TM) 64-Bit Server VM (build 25.60-b23, mixed mode) Maybe this is the reason: https://java.net/jira/browse/GLASSFISH-21272 And, by theway, I can read connection pool attributes by means of the REST-API. I am very grateful for any help. Kind regards, Bård Tørustad ... View more

Hi all, I want to try to monitor the JVMs in our Glassfish-instances (memory, transactions, database connection pools etc) using Splunk. I have tested the Rest API which works fine, likewise the JMX-app. Does anybody have any recommendations as to which of the two are the better in terms of load on the JVM as such. Or are there any alternatives to these two apps? (JVM Instrumentation Agent?) Thank you, Damien, for the Apps! Any help is appreciated. Thanks and regards, Bård Tørustad ... View more

Seemingly after I installed the apps "Splunk App for Windows Infrastructure " and "Windows Add-on" the following error messages are flooding splunkd.log: 03-05-2015 15:48:51.448 +0100 ERROR DispatchManager - The user 'splunk-system-user' does not have sufficient search privleges. 03-05-2015 15:48:51.448 +0100 ERROR SearchScheduler - Error in 'DispatchManager': The user 'splunk-system-user' does not have sufficient search privleges. I do not understand what they mean. At the same time in the audit.log: 03-05-2015 15:48:51.448 +0100 INFO AuditLogger - Audit:[timestamp=03-05-2015 15:48:51.448, user=splunk-system-user, action=search, info=denied , search_id='scheduler__nobody_c3BsdW5rX2RlcGxveW1lbnRfbW9uaXRvcg__RMD589d00151dd198770_at_1425566400_92588', search=' summarize override=partial timespan= max_summary_size=52428800 max_summary_ratio=0.1 max_disabled_buckets=2 max_time=3600 [ search `dm_license_summary_10m_by_pool` ]', autojoin='1', buckets=0, ttl=60, max_count=500000, maxtime=8640000, enable_lookups='1', extra_fields='', apiStartTime='Fri Dec 05 00:00:00 2014', apiEndTime='Thu Jan 01 01:00:00 1970', savedsearch_name="_ACCELERATE_B4CAB4FC-62FD-4955-8951-F2777F04C839_splunk_deployment_monitor_nobody_49ee7cac9a05cfbf_ACCELERATE_"][n/a] 03-05-2015 15:48:51.448 +0100 INFO AuditLogger - Audit:[timestamp=03-05-2015 15:48:51.448, user=splunk-system-user, action=search, info=denied , search_id='scheduler__nobody_c3BsdW5rX2RlcGxveW1lbnRfbW9uaXRvcg__RMD5758fe1b10509f00e_at_1425566400_92589', search=' summarize override=partial timespan= max_summary_size=52428800 max_summary_ratio=0.1 max_disabled_buckets=2 max_time=3600 [ search `sourcetypes_summary_10m` ]', autojoin='1', buckets=0, ttl=60, max_count=500000, maxtime=8640000, enable_lookups='1', extra_fields='', apiStartTime='Fri Dec 05 00:00:00 2014', apiEndTime='Thu Jan 01 01:00:00 1970', savedsearch_name="_ACCELERATE_B4CAB4FC-62FD-4955-8951-F2777F04C839_splunk_deployment_monitor_nobody_463c95b47e289f0f_ACCELERATE_"][n/a] 03-05-2015 15:48:51.448 +0100 INFO AuditLogger - Audit:[timestamp=03-05-2015 15:48:51.448, user=splunk-system-user, action=search, info=denied , search_id='scheduler__nobody_c3BsdW5rX2RlcGxveW1lbnRfbW9uaXRvcg__RMD5b13a71946e1b9d14_at_1425566400_92590', search=' summarize override=partial timespan= max_summary_size=52428800 max_summary_ratio=0.1 max_disabled_buckets=2 max_time=3600 [ search `dm_license_summary_10m_by_source` ]', autojoin='1', buckets=0, ttl=60, max_count=500000, maxtime=8640000, enable_lookups='1', extra_fields='', apiStartTime='Fri Dec 05 00:00:00 2014', apiEndTime='Thu Jan 01 01:00:00 1970', savedsearch_name="_ACCELERATE_B4CAB4FC-62FD-4955-8951-F2777F04C839_splunk_deployment_monitor_nobody_6030b06d30f6e6f4_ACCELERATE_"][n/a] 03-05-2015 15:48:51.448 +0100 INFO AuditLogger - Audit:[timestamp=03-05-2015 15:48:51.448, user=splunk-system-user, action=search, info=denied , search_id='scheduler__nobody_c3BsdW5rX2RlcGxveW1lbnRfbW9uaXRvcg__RMD5825f35f83c8311df_at_1425566400_92591', search=' summarize override=partial timespan= max_summary_size=52428800 max_summary_ratio=0.1 max_disabled_buckets=2 max_time=3600 [ search `dm_license_summary_10m_by_host` ]', autojoin='1', buckets=0, ttl=60, max_count=500000, maxtime=8640000, enable_lookups='1', extra_fields='', apiStartTime='Fri Dec 05 00:00:00 2014', apiEndTime='Thu Jan 01 01:00:00 1970', savedsearch_name="_ACCELERATE_B4CAB4FC-62FD-4955-8951-F2777F04C839_splunk_deployment_monitor_nobody_26e747c470c62ba8_ACCELERATE_"][n/a] 03-05-2015 15:48:51.448 +0100 INFO AuditLogger - Audit:[timestamp=03-05-2015 15:48:51.448, user=splunk-system-user, action=search, info=denied , search_id='scheduler__nobody_c3BsdW5rX2RlcGxveW1lbnRfbW9uaXRvcg__RMD5b453f9e7776e363e_at_1425566400_92592', search=' summarize override=partial timespan= max_summary_size=52428800 max_summary_ratio=0.1 max_disabled_buckets=2 max_time=3600 [ search `sources_summary_10m` ]', autojoin='1', buckets=0, ttl=60, max_count=500000, maxtime=8640000, enable_lookups='1', extra_fields='', apiStartTime='Fri Dec 05 00:00:00 2014', apiEndTime='Thu Jan 01 01:00:00 1970', savedsearch_name="_ACCELERATE_B4CAB4FC-62FD-4955-8951-F2777F04C839_splunk_deployment_monitor_nobody_74744182914e20d1_ACCELERATE_"][n/a] 03-05-2015 15:48:51.448 +0100 INFO AuditLogger - Audit:[timestamp=03-05-2015 15:48:51.448, user=splunk-system-user, action=search, info=denied , search_id='scheduler__nobody_c3BsdW5rX2RlcGxveW1lbnRfbW9uaXRvcg__RMD5cb7dc0fcb8381ee5_at_1425566400_92593', search=' summarize override=partial timespan= max_summary_size=52428800 max_summary_ratio=0.1 max_disabled_buckets=2 max_time=3600 [ search `dm_license_summary_10m` ]', autojoin='1', buckets=0, ttl=60, max_count=500000, maxtime=8640000, enable_lookups='1', extra_fields='', apiStartTime='Fri Dec 05 00:00:00 2014', apiEndTime='Thu Jan 01 01:00:00 1970', savedsearch_name="_ACCELERATE_B4CAB4FC-62FD-4955-8951-F2777F04C839_splunk_deployment_monitor_nobody_28e51b5378d59f27_ACCELERATE_"][n/a] 03-05-2015 15:48:51.448 +0100 INFO AuditLogger - Audit:[timestamp=03-05-2015 15:48:51.448, user=splunk-system-user, action=search, info=denied , search_id='scheduler__nobody_c3BsdW5rX2RlcGxveW1lbnRfbW9uaXRvcg__RMD53af21b05a677c086_at_1425566400_92594', search=' summarize override=partial timespan= max_summary_size=52428800 max_summary_ratio=0.1 max_disabled_buckets=2 max_time=3600 [ search `dm_license_summary_10m_by_forwarder` ]', autojoin='1', buckets=0, ttl=60, max_count=500000, maxtime=8640000, enable_lookups='1', extra_fields='', apiStartTime='Fri Dec 05 00:00:00 2014', apiEndTime='Thu Mar 05 15:40:00 2015', savedsearch_name="_ACCELERATE_B4CAB4FC-62FD-4955-8951-F2777F04C839_splunk_deployment_monitor_nobody_ef0750b59633eb8b_ACCELERATE_"][n/a] 03-05-2015 15:48:51.448 +0100 INFO AuditLogger - Audit:[timestamp=03-05-2015 15:48:51.448, user=splunk-system-user, action=search, info=denied , search_id='scheduler__nobody_c3BsdW5rX2RlcGxveW1lbnRfbW9uaXRvcg__RMD5c2d3abf2a0486f8a_at_1425566400_92595', search=' summarize override=partial timespan= max_summary_size=52428800 max_summary_ratio=0.1 max_disabled_buckets=2 max_time=3600 [ search `indexers_summary_10m` ]', autojoin='1', buckets=0, ttl=60, max_count=500000, maxtime=8640000, enable_lookups='1', extra_fields='', apiStartTime='Fri Dec 05 00:00:00 2014', apiEndTime='Thu Jan 01 01:00:00 1970', savedsearch_name="_ACCELERATE_B4CAB4FC-62FD-4955-8951-F2777F04C839_splunk_deployment_monitor_nobody_3c6084d7f35794cf_ACCELERATE_"][n/a] Thanks for any help, Bård Tørustad ... View more

In the loggfile: [#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et låst oppdrag javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et låst oppdrag ("Kan ikke oppdatere låst oppdrag") In the search result and in the "show source": [#|2011-05-18T11:03:35.375+0200|SEVERE|sun-appserver2.1|com.sun.xml.ws.server.sei.EndpointMethodHandler|_ThreadID=16;_ThreadName=httpSSLWorkerThread-8080-2;_RequestID=93413f1f-5ed3-488e-8843-3872c4d07991;|Kan ikke oppdatere et l\xE5st oppdrag javax.xml.ws.soap.SOAPFaultException: Kan ikke oppdatere et l\xE5st oppdrag ("Kan ikke oppdatere et l\xE5st oppdrag") What can I do to get "låst" instead of "l\xE5st", alternatively how can I search for "l\xE5st"? Thanks and regards, Bård Tørustad Research Council of Norway ... View more

In the logfile (server.log from GlassFish): [#|2011-05-16T17:13:37.622+0200|WARNING|glassfish3.0.1|javax.enterprise.system.core.transaction.com.sun.jts.jta|_ThreadID=61;_ThreadName=Thread-1;|JTS5041: The resource manager is doing work outside a global transaction javax.transaction.xa.XAException: java.sql.SQLException: Failed to enlist:Connection reset by peer: socket write error Searchresult: 5/13/11 12:57:01.000 PM [#|2011-05-16T17:13:37.622+0200|WARNING|glassfish3.0.1|javax.enterprise.system.core.transaction.com.sun.jts.jta|_ThreadID=61;_ThreadName=Thread-1;|JTS5041: The resource manager is doing work outside a global transaction javax.transaction.xa.XAException: java.sql.SQLException: Failed to enlist:Connection reset by peer: socket write error IE Actual time i loggfile is 2011-05-16T17:13:37.622+0200 Time in searchresult is 5/13/11 12:57:01.000 PM I think it is usually correct: 5/13/11 11:54:46.995 AM [#|2011-05-13T11:54:46.995+0200|WARNING|glassfish3.0.1|javax.enterprise.system.core.transaction.com.sun.jts.jta|_ThreadID=62;_ThreadName=Thread-1;|JTS5041: The resource manager is doing work outside a global transaction Why does this happen? Thanks and regards, Bård Tørustad Research Council of Norway ... View more