I just upgraded from Splunk 6.5.2 to 6.6.2 and now the emailing of alerts when using STARTTLS is broken. Looking at the splunkd.log file I can see the error ERROR:root:EOF occurred in violation of protocol (_ssl.c:676) . Email works correctly if I disable the SMTP STARTTLS option in email settings which is less than ideal. ... View more

I'm not wanting to monitor these events and yet the scripts still run every minute (by looking at the task manager). I have tried adding stanzas to disable them in etc/system/local/inputs.conf but this doesn't seem to work, the still run. [script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path] disabled = 1 [script://$SPLUNK_HOME\bin\scripts\splunk-netmon.path] disabled = 1 [script://$SPLUNK_HOME\bin\scripts\splunk-winprintmon.path] disabled = 1 [script://$SPLUNK_HOME\bin\scripts\splunk-powershell.path] disabled = 1 [script://$SPLUNK_HOME\bin\scripts\splunk-powershell2.path] disabled = 1 [WinRegMon] disabled=1 [WinNetMon] disabled=1 [WinPrintMon] disabled=1 [perfmon] disabled=1 [admon] disabled=1 [powershell] disabled=1 [powershell2] disabled=1 I can see in the splunk.log file the following INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe" INFO ExecProcessor - interval: 60000 ms INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe" INFO ExecProcessor - interval: 60000 ms INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe" INFO ExecProcessor - interval: 60000 ms INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" INFO ExecProcessor - interval: run once INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" INFO ExecProcessor - interval: 60000 ms INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2 INFO ExecProcessor - interval: 60000 ms INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" INFO ExecProcessor - interval: 60000 ms INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe" INFO ExecProcessor - interval: 60000 ms INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe" INFO ExecProcessor - interval: 60000 ms ... View more

Hi, I'm running the latest Splunk indexer and forwarders (6.2.1) with my indexer on Linux and my forwarders on Windows 2008 R2. I've also deployed the Splunk Add-on for Microsoft Windows (4.7.3) on both the indexer and forwarders. I'm seeing a lot of the following errors in my splunkd.log WARN SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='Security_ID_as_src_nt_domain' WARN SearchOperator:kv - Missing FORMAT for: transform_name='Security_ID_as_src_nt_domain' What are these errors from and how can I fix them? ... View more

Development on the Shuttl app seems to have stopped, is this app still supported and going to be actively developed? I started using this app to allow us to archive our frozen buckets in S3 however I disabled it due to concerns about the format of the stored data as I wasn't able to retrieve the data manually from S3 in any meaningful way. I would like to start using this app again but not if development has stalled. ... View more