Is machine 1 configured to send its internal logs to the indexers? ... View more

Splunk Supports IPv6 both sending and receiving. Further information can be found in our documentation: http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/ConfigureSplunkforIPv6 Also keep in mind when trying to send only to Ipv6 networks server.conf settings will also be needed, e.g. listenOnIPv6 = no|yes|only * By default, splunkd will listen for incoming connections (both REST and TCP inputs) using IPv4 only * To enable IPv6 support in splunkd, set this to 'yes'. splunkd will simultaneously listen for connections on both IPv4 and IPv6 * To disable IPv4 entirely, set this to 'only', which will cause splunkd to exclusively accept connections over IPv6. You will probably also need to change mgmtHostPort in web.conf (use '[::1]' instead of '127.0.0.1') * Note that any setting of SPLUNK_BINDIP in your environment or splunk-launch.conf will override this value. In that case splunkd will listen on the exact address specified. connectUsingIpVersion = auto|4-first|6-first|4-only|6-only * When making outbound TCP connections (for forwarding eventdata, making distributed search requests, etc) this controls whether the connections will be made via IPv4 or IPv6. * If a host is available over both IPv4 and IPv6 and this is set to '4-first', then we will connect over IPv4 first and fallback to IPv6 if the connection fails. * If it is set to '6-first' then splunkd will try IPv6 first and fallback to IPv4 on failure * If this is set to '4-only' then splunkd will only attempt to make connections over IPv4. * Likewise, if this is set to '6-only', then splunkd will only attempt to connect to the IPv6 address. * The default value of 'auto' will select a reasonable value based on listenOnIPv6 setting. If that value is set to 'no' it will act like '4-only'. If it is set to 'yes' it will act like '6-first' and if it is set to 'only' it will act like '6-only'. * Note that connections to literal addresses are unaffected by this. For example, if a forwarder is configured to connect to "10.1.2.3" the connection will be made over IPv4 regardless of this setting. ... View more

I think you may want to look at embed reports... http://docs.splunk.com/Documentation/Splunk/6.3.4/Report/Embedscheduledreports ... View more

Remember that setting is applied to a bucket as a whole not individual events. So in order for Splunk to freeze a bucket all events in a bucket must be past the frozentimeperiodinsecs ... View more

After reviewing the end user install, I see that Splunk DB Connect 1 ver 1.2.2 or lower is installed on the Splunk Instance with the issue. As the app is not rated for Splunk 6.4 according to Splunkbase it should not be on the system, but it is. Way to fix, is you have to remove the entire app from the Splunk File Structure, restart splunk and you should be able to see the remote inputs again. Disabling the app will not correct the issue, you will need to remove the entire contents of: %SPLUNK_HOME/etc/apps/dbx from the splunk system and restart splunk service for the changes to take affect. ... View more

With Email, sometimes it is just easier to attempt to deliver a message using telnet from the command line of the server to see what is the issue with email server. Here is great technet article that describes the smtp commands: https://technet.microsoft.com/en-us/library/aa995718%28v=exchg.65%29.aspx If you get the same error response you can eliminate Splunk from the issue, and focus on the mail server, from address, to address etc as being the issue. ... View more