Thx for this post - got my KV store going again. It seems like the upgrade to 7.2.x would have done this step for you since it was a required step! ... View more

For more troubleshooting info on receiving try this command: splunk list inputstatus This gives you a listing of every way an indexer is receiving data from each host and when Hope this helps!! ... View more

I setup a small lab at home on my vmware server containing several linux servers - proxy, dns, http, mysql, postfix etc. Sent all of my router info to Splunk through udp to capture firewall events and potential attacks. Also forwarded a few Windows laptops to Splunk which generates a bunch of data. Once you point your laptops to browse the internet through your proxy server and dns server you will have plenty of data. Just get creative with data you are already generating and capture it. Good Luck! ... View more

This helped me as well. With 2 indexer clusters, one started acting this way. Simply added [_introspection] repFactor = auto into my $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf and it fixed it. These splunk bugs are really annoying and make my job twice as hard as it should be. ... View more

Thanks! This fixed my issue as well ... View more

I was able to make it work with these files: I am converting binary data to ascii data with a perl script as the unarchive_cmd inputs.conf [monitor:///var/log/huawei/*.cdr] disabled = false followTail = 0 host = huawei_switch index = huawei sourcetype = huawei_cdr props.conf [source::/var/log/huawei/*.cdr] invalid_cause = archive unarchive_cmd = /usr/local/bin/huawei2text.pl sourcetype = huawei_cdr NO_BINARY_CHECK=true Caveat 1: The props.conf file would not work if I used sourcetype [huawei_cdr] instead of the [source::/var/log/huawei/*.cdr] listed above. Caveat 2: It would not work with a "known" file type such as .dat or .txt I found this out by running splunk in debug mode and it set the priority for it's understanding of a .dat file higher than what I was telling it in my props and inputs files. I changed the extention to a .cdr file and it was able to execute the unarchive_cmd and index the binary files properly. Hope this helps! ... View more

The free version does not ask for a password - it is wide open to whoever has the URL. I also believe that you cannot forward to the free version. At least that used to be the case... ... View more

The splunkd.log is most likely already being sent by the forwarder but you may not be searching the internal indexes by default. Try this search: index=_internal source="/opt/splunkforwarder/var/log/splunk/splunkd.log" host=hostname ... View more

In 6 on Windows with the Universal Forwarder, it seems that the config files have moved to C:\splunkuniversalforwarder\etc\apps\splunk_ta_windows\local\inputs.conf This is the file I had to change to point the data to specific indexes. You may try a search for other inputs.conf and see if you have one in a similar location - depending on the path you chose for $Splunk_Home ... View more

Make sure that you put index=_internal in your search if you are trying to query the splunkd.log files. I could not see mine even signed on as admin and starting the search with index="*" ... View more

This worked well | rex mode=sed "s/(/""/g" | rex mode=sed "s/ ) /"-"/g" It converted (888) 555-4444 to 888-555-4444 Probably be faster in transforms.conf. Now, does it really work for a join? ... View more

Thanks! That helps. I am going to try something like this | rex mode=sed "s/(/""/g" | rex mode=sed "s/) /"-"/g" Will update here if it works! ... View more