for now, the "Use the CLI" section of this doc may help: http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/Configureyourinputs#Use_the_CLI ... View more

ok, thnx. i'm looking into it/trying to re-produce the issue. ... View more

could you post a screen-shot? if you have a server class defined that contains the forwarder(s) you're trying to enable the tcp/udp input on then there shouldn't be a problem. thnx ... View more

not searchable? have you tried "index=wineventlog *" ... View more

As a base-line i'd say 1st verify that the splunkd process owner can write to /opt/splunk/var/lib/splunk/audit/db. ... View more

using the "curl" example in the docs i was able add an event to Splunk Light via the HTTP Event Collector. curl -k https://localhost:8088/services/collector/event -H "Authorization: Splunk " -d '{"event": "hello world"} ... View more

As a base-line i'd say 1st verify that the splunkd process owner can write to /opt/splunk/var/lib/splunk/audit/db. ... View more

If the audit logs are already on disk/exist, it's easy. if not, it sounds like you need to look at scripted inputs. ... View more

Assuming by "switches" you mean "logs out of the 1st session & logs in again using a different account", that would be pretty difficult to do w/certainty. If you are indexing network traffic & can ascertain that the admin logged in from the same ip that the non-admin just logged out from, that would be a good indication but who's to say the source ip system was not shared? Splunk provides a very flexible logging system that provides quite a bit of granularity w/regards to how much info is logged but determining who was sitting at a particular keyboard is going to be tough. Another approach might be to correlate "guest" activity w/the admin activity: if the guest was looking at a particular alert, for instance & then an admin logged in and modified that same alert then that's significant. ... View more

satishsdange gravatar image satishsdange · 3 days ago 1 I am suspecting a permission issue with your instance. Please refer to below link - http://docs.splunk.com/Documentation/Splunk/6.3.3/Installation/InstallonLinux Add your comment... jterry gravatar image jterry [Splunk] satishsdange · 2 days ago yes, it's almost certainly a disk/filesystem permissions issue. Essentially, the user that is trying to run splunk doesn't have write access to /opt/splunkforwarder/. Probably. Add your comment... jbailey_splunk gravatar image jbailey [Splunk] jterry · 3 hours ago From /opt, run "chown -R : splunkforwarder" (to change ownership) Then, "chmod -R 744 splunkforwarder" (change permissions on everything contained within splunkforwarder) - being the user that should own these files and directories - being the group assigned to the user Determine the user/group that should be accessing Splunk and make that change appropriately to the files and directories. If you used an rpm to install, the user and group should be splunk, so an example would be: cd /opt chown -R splunk:splunk splunkforwarder chmod -R 744 splunkforwarder Hope this helps... ... View more

i think the hosts listing on the home page derives it's values from the data that's been ingested, namely the "host=" field. If no data has been sent by the forwarder(s) in question, then it/they will not appear in the listing. Additionally, if a forwarder is sending data but that data already has a "host" field in it, that value may preclude the forwarders inclusion in the list. If a global search "*" returns data/events then look at the hosts value attached to them. Those values should be listed on the home page. ... View more

here's a good doc: http://docs.splunk.com/Documentation/Splunk/6.0/Troubleshooting/WhatSplunklogsaboutitself ... View more

whichever. i'd assume the context of the original question ... View more

Assuming by "switches" you mean "logs out of the 1st session & logs in again using a different account", that would be pretty difficult to do w/certainty. If you are indexing network traffic & can ascertain that the admin logged in from the same ip that the non-admin just logged out from, that would be a good indication but who's to say the source ip system was not shared? Splunk provides a very flexible logging system that provides quite a bit of granularity w/regards to how much info is logged but determining who was sitting at a particular keyboard is going to be tough. Another approach might be to correlate "guest" activity w/the admin activity: if the guest was looking at a particular alert, for instance & then an admin logged in and modified that same alert then that's significant. ... View more

splunk supports queries from the CLI. How about: "[splunk_home]/bin/splunk search [my filter] | my_forwarding_script.sh" ? ... View more

v6.4 doesn't seem to have this problem... 2016-04-04 17:42:11,121 -0700 ERROR sendemail:128 - Sending email. subject="Splunk Alert: test", results_link="http://host:8000/app/search/@go?sid=scheduler__admin__search__test_at_1459816800_5", recipients="[u'[email protected]']", server="10.123.123.123" 2016-04-04 17:42:11,121 -0700 ERROR sendemail:393 - [Errno 110] Connection timed out while sending mail to: [email protected] 04-04-2016 17:42:11.122 -0700 ERROR ScriptRunner - stderr from '/home/user/light/splunk/bin/python /home/user/light/splunk/etc/apps/search/bin/sendemail.py "results_link=http://host:8000/app/search/@go?sid=scheduler__admin__search__test_at_1459816800_5" "ssname=test" "graceful=True" "trigger_time=1459816801" results_file="/home/user/light/splunk/var/run/splunk/dispatch/scheduler_adminsearch_test_at_1459816800_5/results.csv.gz"': ERROR:root:[Errno 110] Connection timed out while sending mail to: [email protected] ... View more

If the audit logs are already on disk/exist, it's easy. if not, it sounds like you need to look at scripted inputs. ... View more

splunk supports queries from the CLI. How about: "[splunk_home]/bin/splunk search [my filter] | my_forwarding_script.sh" ? ... View more

not searchable? have you tried "index=wineventlog *" ... View more

If the data you want to index/search is already in a file, a simple file monitor input will suffice. If not, a scripted or modular input may be the way to go. ... View more

The distinction between a forwarder & a deployment client is blurred in SL. For forwarding all you need to do is open/listen to a port on the server & tell the forwarder to send data there. (splunk add forward-server ...). In the latest release, it's recommended that all forwarders also be deployment clients (splunk set deploy-poll ...). This ties into the server class concept where forwarders (configured as deployment clients) can be managed in groups. ... View more

yes, it's almost certainly a disk/filesystem permissions issue. Essentially, the user that is trying to run splunk doesn't have write access to /opt/splunkforwarder/. Probably. ... View more

does Splunk Enterprise do the same thing? ... View more

Officially, Light has the same requirements as a single-instance configuration of Enterprise. That said however, you could just give it a try & see how it goes. ... View more