Thx for this post - got my KV store going again. It seems like the upgrade to 7.2.x would have done this step for you since it was a required step! ... View more

for a wide variety of logs please check out this site https://ossec-docs.readthedocs.io/en/latest/log_samples . you can then use eventgen app in splunk to generate runtime logs based off these samples. ... View more

yes, commenting out SSLv3 from Java.security file worked! thank you very much!!!!! ... View more

I have not tested this - based on others' comments, it's possible the issue is likely not having setting repFactor explicitly defined for the _introspection index. Therefore, explicitly setting this index to repFactor = auto might be the best solution, especially if you [default]:repFactor = auto. And as @claudio.manig suggests, I recommend opening a support case with Splunk on this if you're continuing to have issues. ... View more

In 6 on Windows with the Universal Forwarder, it seems that the config files have moved to C:\splunkuniversalforwarder\etc\apps\splunk_ta_windows\local\inputs.conf This is the file I had to change to point the data to specific indexes. You may try a search for other inputs.conf and see if you have one in a similar location - depending on the path you chose for $Splunk_Home ... View more

This worked well | rex mode=sed "s/(/""/g" | rex mode=sed "s/ ) /"-"/g" It converted (888) 555-4444 to 888-555-4444 Probably be faster in transforms.conf. Now, does it really work for a join? ... View more

Make sure that you put index=_internal in your search if you are trying to query the splunkd.log files. I could not see mine even signed on as admin and starting the search with index="*" ... View more