i had a similar issue. make sure that the sourcetype on the data returned matches the sourcetype in your automatic lookup definition ... View more

Now that I turned that off, I don't get the fields for the Nix search. I suspect that's because change the permissions to app only kills the field extractions. ... View more

This fixed my issue. Thank you so much. I literally spent about 10 hours trying to solve this. ... View more

If you are getting this error An error occurred: Could not create Splunk settings directory at '/root/.splunk' Then make sure you run the process as the user you typically run splunk from. splunk in my case. sudo su splunk [splunk@servername5001 /opt/splunk/etc](603) $ /opt/splunk/bin/splunk reload deploy-server Your session is invalid. Please login. Splunk username: admin Password: Login successful, running command... Reloading serverclass(es). [splunk@servername /opt/splunk/etc](604) ... View more

In my AWS account, we have a master account with 90 sub-accounts. We build the Splunk user into the account using automation so it would be nice to generate the passwords.conf file. This is a huge pain for me right now. If you can tell me the hash algorithm you used to hash the password (e.g. MD5) I could easily generate it. ... View more