You (user=admin) do not have permission to perform this operation (requires capability: edit_search_head_clustering). The error denotes that the user does not have the capability to perform the action. You can tweak the authorize.conf or from GUI, Access controls » Roles » *** and provide the access under Capabilities. By default, an admin will have the privilege. ... View more

you can download a different Splunk version, ex: 7.2.5.1 and copy only sendemail.py from 7.2.5.1 and replace it with 7.2.6 Note: Let me know the challenges you're facing with Work Around 2, It should work ... View more

I assume you have the add-on installed on HF / Indexer and SH and you want to know where to configure the inputs and ensure not to make duplicate data by configuring on multiple instances. If the above is the case, then below is the answer to it. If not, please provide more information on your requirement. Add-ons that contain inputs belong on forwarders, and in some select cases also on search heads. Inputs that contain dynamic lookups need to be installed on search heads because they feed results back into the input directly from the search. Consult the documentation of the add-on for special instructions. https://docs.splunk.com/Documentation/AddOns/released/Overview/Wheretoinstall ... View more

Can you check the internal logs to find out the reason? Look for scheduler source type and splunk_python. ... View more

Can you try the below and check if it works: rpm -ivh --nodeps splunk-7.1.6-8f009a3f5353-linux-2.6-x86_64.rpm ... View more

Generally, a data model Provides more meaningful representation of underlying raw machine data. It breakdown the complex events into understanding pieces. Data models enable users to create compelling reports and dashboards without having to write the searches that generate them. In Bookish words, A data model is a hierarchically structured search-time mapping of knowledge about one or more datasets. Three points to remember: A Data Model is a Collection of Objects. Objects Have Constraints and Attributes. Child Objects Inherit Constraints and Attributes. datamodels.conf is a configuration file which contains possible attribute/value pairs for configuring data models. Before knowing about acceleration.max_concurrent = 1, You must be aware of Data Model Acceleration. A data-summary-backed method of accelerating the datasets within data models, causing pivot searches on that dataset to run much faster than they would otherwise. The collection of summaries that a data model uses for acceleration is called the high performance analytics store. ... View more

we need to isolate the reason why this could happen in indexer. Are you using VMs? If not, check disk health and IOPS, e.g. with Bonnie++ Go to your master and take a look at the DMC, specifically Indexing -> Performance -> Indexing Performance: Instance (select affected indexer) https://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Troubleshootindexingperformance Create a support ticket with splunk if the above doesn't help ... View more

I suppose you need to just take out the file from that folder and try again that would help. d52190c329a27ebe07129537c6adbd76-1541522317.bundle ... View more

Check the below link: https://answers.splunk.com/answers/5590/could-not-send-data-to-the-output-queue.html Most cases this occur due to congestion on the indexer side. you need to look into the "QUEUES" and sort out based on which queue is filled. For example, look for line breaking/truncating for parsing queue; dateparserververbose for aggregation queue, regex for typing queue and check the IOPS value ( random seeks ) if the indexing queue is filled, ensure that you have 800 IOPS value on the indexer. DId the temporary workaround helped? ... View more

Check and confirm if you're using chrome latest version. Also, have you tried with other browsers? Like Firefox ... View more

This lookup comes from Palo Alto app, check whether the below link is helpful. Check app compatibility as well. https://answers.splunk.com/answers/590248/error-at-search-time-after-upgrading-palo-alto-net-1.html ... View more

It worked. thanks !! ... View more

Have you found any solution for this issue? ... View more

This could be because of stale PID files which reside under SPLUNK_HOME/var/run/splunk that causes splunk not to start. Step 1: rm $SPLUNK_HOME/var/run/splunk/splunkd.pid Step 2: $SPLUNK_HOME/bin/splunk status Step 3: $SPLUNK_HOME/bin/splunk start ... View more

This worked. THanks ... View more

This has worked for me, thank you! ... View more