This happens to us when the c drive (installation drive) does not have enough space for Splunk to process temp files that use disk space and then are cleaned. If there is not enough space then that error shows up. We expand the space on our C drive and the error goes away.,That usually indicates that your C drive is filling up due to temporary files that use space during searches. When this happens to our servers we increase the size of the c drive. ... View more

Here is a simple tutorial on the difference: http://www.mathsisfun.com/data/standard-deviation.html ... View more

Using ldapsearch 2.1.0 it is really useless because of the very long search times. Is there more thought on how to reduce the search times? This is my ldap.conf [default] alternatedomain = SPL1 basedn = DC=PRK,DC=LOCAL binddn = CN=SyyyyySA,OU=Service Accounts,OU=Special User Objects,DC=PRK,DC=LOCAL port = 636 server = yyy.yy.y.yy ssl = 1 [prk.local] alternatedomain = SPL ... View more

I am having the same issue. I am also on 6.2.3 ... View more

The log needs to be plain text. Each event needs a time stamp. If that is true you read it in and then create field extracts with regex. You can manually do the regex or let Splunk's GUI create the regex. I have read in logs that have unusal timestamps June 11 2015 06:00 some event data 06:12 some event data 06:14 some event data June 12 2015 00:05 some data 00:15 some data I have written scripts in powershell and phython that simply reads until the date is found then read the times and insert the date before the time write out the newly formated event line to a new file keep reading until a new date is found. write new log to disk splunk reads the new log I have also used a script output to send the log directly to Splunk. Both are really simple to do. ... View more

The Splunk for Blue Coat ProxySG App 3.0.7 converts the old sourcetype bcoat_log to bcoat_proxysg. The TA-BlueCoat addon for the heavy forwarder sets the timezone to UTC with TZ=UTC under the [bcoat_log] property. The [bcoat_proxysg] property does not set the timezone. The default is for Blue Coat to send UTC. That will cause all of your events to be indexed at UTC but Splunk believes the timestamp to be local time. You can see the issue if you monitor the events in realtime. You will notice that the Blue Coat timestamp is UTC and the _time is set to the same time which is UTC although Splunk believes this to be local time. For EST timezone that caused events to be indexed 4 hours in the future. Any searches or alerts would not see the events until the 4 hours passed. The solution is to set the TZ to UTC within the [bcoat_proxysg] property. I did not want to modify the TA-BlueCoat addon so I modified the props.conf on the heavy forwarder indexing the Blue Coat syslogs under splunk/etc/system/local with: [bcoat_proxysg] TZ = UTC Now Splunk understand the Blue Coat event times to be UTC and Splunk properly converts to local time. Looking at the _raw event the _time is local while the _raw event shows the UTC. This is now what is expected. ... View more

I had a similar issue and found that I had an outputs.conf file in my etc/system/local directory that was being used instead of the outputs.conf in my app directory. I renamed the wrong outputs.conf file and restarted Splunk. You can tell if your outputs.conf file is being used as the sslPassword = testmy123 will be encrypted after it is read the first time. If you have an outputs.conf file in another directory being used first it may be that it is using a different port which is another indication that the wrong outputs.conf file is being used. ... View more

The link that rbal_splunk gave seems to be broken. I found it here: http://wiki.splunk.com/Community:TroubleshootingWMIIssues although it seems to be the same link except a comma got stuck on the end of the link. ... View more

We use LDAP lookup which will lock the domain account based on your policy. ... View more

Are you having Splunk run the script? Check: https://answers.splunk.com/answers/151792/how-to-import-text-file-results-of-a-powershell-script-when-app-is-opened.html#answer-152068 https://answers.splunk.com/answers/151792/how-to-import-text-file-results-of-a-powershell-script-when-app-is-opened.html https://answers.splunk.com/answers/151962/how-to-configure-scripted-inputs-and-check-if-they-are-running.html I hope those give you some ideas. ... View more

I find it interesting that the app is released before it has gone through quality control. ... View more

I am having the same issue. Did you find the solution? ... View more

I have found SecureWork's document very useful for security event best practice. ` [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 index = winevents #based on SecureWorks Windows Log Monitoring Best Practices for Security and Compliance whitelist = 517,520,529,530,531,532,533,534,535,536,537,539,540,560,565,566, 601,608,609,610,611,612,617,620,621,622,624,626,627, 628,629,630,631,632,633,634,635,636,637,638,639,641,642,643,644,645,646,647,648,649,650,651,652,653, 654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,671,672,673,675,676,680,681,685, 1102,4616, 4624,4625,4656,4661,4662,4688,4697,4704,4705,4706,4707,4708,4713,4716,4717,4718,4719,4720, 4722,4723,4724,4725,4726,4727,4728,4729,4730,4731,4732,4733,4734,4735,4737,4738,4739,4740, 4741,4742,4743,4744,4745,4746,4747,4748,4749,4750,4751,4752,4753,4754,4755,4756,4757,4758, 4759,4760,4761,4762, 4763,4764,4767,4768,4769,4771,4776,4781,4906 ` ... View more

The link provided from mkinsley_splunk shows the export button but it always produces an 8 byte file with binary data. I tried, explorer, firefox, and chrome. I'm using version 2.0.4 Splunk 6.0.1 ... View more

The link provided from mkinsley_splunk shows the export button but it always produces an 8 byte file with binary data. I tried, explorer, firefox, and chrome. I'm using version 2.0.4 Splunk 6.0.1 ... View more

The link provided from mkinsley_splunk shows the export button but it always produces an 8 byte file with binary data. I tried, explorer, firefox, and chrome. I'm using version 2.0.4 Splunk 6.0.1 ... View more

The link provided from mkinsley_splunk shows the export button but it always produces an 8 byte file with binary data. I tried, explorer, firefox, and chrome. I'm using version 2.0.4 Splunk 6.0.1 ... View more