So I got this added in the transforms.conf file located at $SPLUNK_HOME/etc/system/local/ I re-ran the search, and still getting the same results. ... View more

This is good information, but I'm not entirely sure on how to get this to be able to search ... View more

I can't run the above search. I am still getting the same error messages... The minimum free disk space 8000mb reached for /opt/splunk/var/run/splunk/dispatch And The index processor has paused data flow. Current free disk space on partition / has fallen to 4603Mb below the minimum of 5000MB Data writes to index path /opt/splunk/var/lib/splunk/audit/db' cannot safely proceed. I'm also seeing failed to start KV Store process. See mongod.log and splunkd.log for details. KV store changed status to failed. KVSTore process terminated. ... View more

Thank you for the information, unfortunately, I am still not able to search. I did clear the dispatch directory, and restarted splunk and still cannot search. I am still getting the error messages, and I have checked root and I am completely fine on space. If you have any more ideas, please let me know. ... View more

Hey there, I apologize for the delay on this matter, but I would definitely love to share my findings. Currently I have built a ESXi lab and I have installed the Splunk TA windows app in my Indexer and my UF. I can see DHCP logs getting sent via index=windows sourcetype=DhcpSrvLog. So I know the Splunk TA app works fine. On my production side: Here's my issue. I have multiple Domain Controllers to which are running as DHCP servers for our infrastructure, and I have found the file path it is exporting the logs to. I believe the issue why it is not showing in my production environment is maybe due to having multiple Deployment Servers, one indexer, and a search head. VS, my lab that has one indexer, and UFs sending data. Our DCs, we do not have access to install the Splunk_TA app...But we do have the TA app on our deployment servers... I'm just trying to figure out the best solution with our infrastructure to get this working since I know the directory where the logs are being stored. Any help is appreciated. ... View more

Here is my output netstat -ntpul | grep 8000 tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 21621/splunkd ... View more

Thank you! I appreciate the feedback! I will check ... View more

Thank you, I appreciate the suggestion! Just one minor detail, I do see events when doing an index=wineventlog search. But specifically no results for DHCP. ... View more

Per the conf files, we do have windows, but running an index=windows search no results come back. I did change the DHCP index to wineventlog, and still when running a search, DhcpSrvLog shows no results. ... View more

I am reloading the deployment server after every edit to the conf file. And yes, it sure does. As far as running the series command series= there is no data. I apologize about that. ... View more

Running index=_internal sourcetype=splunkd series=DhcpSrvLog shows no results. But it does show results without the "series" parameter. The SplunkForwarding Service is running as system. I have also ran index=windows sourcetype=DhcpSrvLog with no results. In the inputs.conf file, I have changed the DHCP stanza to index=wineventlog, and ran the new index search with no results. I have since changed it back to default to run the index=windows again ... View more

Yes, it is enabled on all of our production servers in our environment. But even if it was not, we should still be able to see the sourcetype when making a search? ... View more