This answer has helped me too. As above I set all intervals to -1 in etc/system/local/inputs.conf. (Except WinEventLog because I monitor Windows Event Logs.) I noticed that the file etc/system/default/inputs.conf on my Windows Universal Forwarder contains the following lines: [admon] interval=60 baseline=0 [MonitorNoHandle] interval=60 [WinEventLog] interval=60 evt_resolve_ad_obj = 0 evt_dc_name= evt_dns_name= [WinNetMon] interval=60 [WinPrintMon] interval=60 [WinRegMon] interval=60 baseline=0 [perfmon] interval=300 [powershell] interval=60 [powershell2] interval=60 ... View more

I realize this question is from 2013. However, I had a very similar issue today. The error message was: ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment I installed Splunk as follows: First, I had extracted the tgz archive on my Linux system via sudo. Then I chowned the directory to the splunk user. Then, I ran "/opt/splunk/bin/splunk enable boot-start -user splunk" via sudo. Then, I tried to "splunk start" as the splunk user. However, I received the error message above. I noticed the following permissions on the file /opt/splunk/etc/splunk-launch.conf: -rw-r----- 1 root root 830 Sep 7 10:29 splunk-launch.conf So the splunk user had no permission to read this file. So I did the following: sudo chmod a+r /opt/splunk/etc/splunk-launch.conf ... View more

Upvoted. Rebooting the Check Point managent server helped. ... View more

I had the same issue. This blog post by Splunk helped me: I can’t make my time range picker pick my time field. ... View more

A couple of days ago Nessus 7.0.2 was released. The release notes for 7.0.2 specify: Reinstate API functions related to integrations. I just tested the Splunk add-on: Apparently it is working again. Perhaps Tenable faced too much backlash when disabling the API, so they changed their decision. Unfortunately, I cannot find any official word from Tenable as to whether the API is fully back now. ... View more

I had a similar issue. Since it is recommended to use a syslog server instead of sending syslog straight to Splunk, I put up an rsyslog server. My rsyslog server had the option %FROMHOST% to put incoming syslog traffic into /data/<reverse dns or ip address>/syslog So each syslog client had a log file like /data/test.local/syslog (if reverse DNS was available) or /data/192.168.0.10/syslog. The Splunk directory monitor had the option "host_segment = 2", so the host field should either be the FQDN or the ip address. However, the syslog sourcetype overwrote the host value via "TRANSFORM = syslog-host". I did not like this behaviour. So like you I made the following changes via etc/system/local/props.conf on my heavy forwarder (because that's where the indexing phase took place): [syslog] TRANSFORM = So I think you are handling this just fine. ... View more

Can you verify whether you are running a universal forwarder or a heavy forwarder? Check the installation directory. All I can think of is that your universal forwarder is in reality a heavy forwarder. For the universal forwarder, the installation directory should be /opt/splunkforwarder or c:\Program Files\SplunkUniversalForwarder. For the heavy forwarder, it should be /opt/splunk or c:\Program Files\Splunk. ... View more

Try it like this: [yoursourcetype] LINE_BREAKER = ( )\d\d\.\d\d\.\d\d\d\d \d\d:\d\d As you can see it should work: screenshot (I autotranslated your input file.) If it still does not work, can you post your props.conf? I would like to see the relevant stanza. Also, don't forget to restart Splunk after editing configuration files. ... View more

So you have a universal forwarder on a Windows system which forwards to another universal forwarder which in turn forwards to the indexer? Are you sure the intermediate Splunk instance is a universal forwarder? You can use btool to troubleshoot your configuration. Run "splunk btool props list" and "splunk btool props list" to see the actual configuration which Splunk uses. Check that your stanzas appear as expected. ... View more

Are you running a single instance of Splunk? Or do you have multiple insances? This configuration (via props.conf) needs to be placed on the instance where the indexing phase happens. That could be a heavy forwarder. Set SHOULD_LINEMERGE=false (along with the LINE_BREAKER option) and see if that makes a difference. ... View more

Try REGEX = HealthMailbox instead of REGEX = "HealthMailbox". Do you have a heavy forwarder in place? Perhaps there is a heavy forwarder between the indexer and a universal forwarder? If so, you need to put this configuration on the heavy forwarder. ... View more

I noticed that you wrote transform.conf instead of transforms.conf. Make sure the file is named transforms.conf. The regex should be: REGEX = HealthMailbox Restart Splunk after making those changes. ... View more

You're welcome. 🙂 ... View more

Could you post your indexes.conf configuration? What about disk space? Does the partition (where the indexes are located) have enough free space? ... View more

What I find confusing is that the openPortsEnhanced script produces an output line for each open port plus one output line in the form of "... file_hash=(stdin)=...". This last line (whatever its purpose) is correctly visible in the screenshot of your original post. However, the other lines (the open port lines) are missing. Maybe your search is wrong. Try a Splunk search like: index=* sourcetype="Unix:ListeningPorts". Perhaps you can find error information in the internals logs. Search for something like: index=_* openPortsEnhanced.sh. ... View more

Try to run the script directly and see what happens: Change into the directory etc/apps/Splunk_TA_nix/bin and execute the script via ./openPortsEnhanced.sh The output should be something like this: [root@myhost bin]# ./openPortsEnhanced.sh Fri Feb 2 13:33:15 CET 2018 app=ntpd dest_ip=* dest_port=123 pid=634 user=ntp fd=16u ip_version=4 dvc_id=15331 transport=UDP Fri Feb 2 13:33:15 CET 2018 app=ntpd dest_ip=* dest_port=123 pid=634 user=ntp fd=17u ip_version=6 dvc_id=15332 transport=UDP ... Having a look at the script, it runs the following command to get a list of the open ports: lsof -i -P -n What happens when you execute this command? Perhaps you need to install lsof. ... View more

I'm looking forward to it! ... View more

https://answers.splunk.com/answers/114078/splunk-6-dropdown-menu-decrease-width.html worked for me. ... View more