This helped me fix my issue! Thanks! ... View more

STEP: 1 From the search bar open service app and then find out window installer and start/restart it.   STEP: 2 Run cmd as an administrator and excute these commands one by one. msiexec /unreg msiexec /regserver regsvr32 vbscript.dll And then restart your system. I hope this on will help you... ... View more

Ok thanks, it seems that the logfiles of yesterday are in. But then I've got 2 other questions. - after how many time the files are uploaded? - it seems that I have to search on: source="c:\test\test1.log" - How can I search on a folder? ... View more

Hi, which version are you using? In 6.4.3, according to inputs.conf you can use multiple groups... haven't tested. Don't know whether this works in props/transforms. One other option I have in mind is to use CLONE_SOURCETYPE and route this new sourcetype to an additional group. It's possible to do this props.conf: [orig_sourcetype] TRANSFORMS-clone = clone_orig [cloned_sourcetype] TRANSFORMS-route = route_clone transforms.conf [clone_orig] REGEX = (.*) FORMAT = $1 DEST_KEY = _raw CLONE_SOURCETYPE = cloned_sourcetype [route_clone] REGEX = . DEST_KEY=_TCP_ROUTING FORMAT=indexercluster2 outputs.conf should stay the same...? Does it work for you? You should be able to add more transforms for the "new" sourcetype... maybe even renaming it again? Or use a sourcetype alias on the second indexers group. HTH, Holger ... View more

I had noticed this in the header of access_generator.py which warranted my question: access_generator.py Needed to develop initial access tokens for script use. Currently in Beta version. Email me to get instructions on usage. I need to automate process still. - JB ''' ... View more

No problem, I appreciate your willingness to try and help. I realize this thread has gone beyond where it should, so I opened a support case yesterday. I'll post an update when I have one. ... View more

Got the problem now. You're using "|where" clause for filter based on Domain. The wildcard for it is "%" not "*" . So you got two option to solve your problem. 1) In dropdown, change the value for "All" option to % replace All with All 2) In your query, replace where with search which accepts * as wildcard. replace | where Ministry ="$Ministry$" with | searchMinistry ="$Ministry$" ... View more

there was an access list configured on our SMTP server. that was the issue. many thanks for the help. ... View more

Ok, thank you all VERY much for your help guys! I think I found the reason. I seem to have tried to open and manually edit the props.conf WHILE it was being used by the Splunk software. I believe it somehow caused an error and from then onwards my defined source type was internally flagged as corrupt. I could not even get it to work after reloading Splunk. I completely deleted my props.conf and made a new one. Seems to work fine so far. From now on, I will make sure not to open it while it is being processed by Splunk. At least that is how I think it caused problems for me. I will report back if I still encounter problems. Regards to all and thanks for helping! Great Splunk community obviously. -SKless ... View more

Thank you dgrubb. I'm thinking the same way as you wrote. Just needed confirmation from someone else. ... View more

Yes: it looks like you have overlapping stanzas, which can certainly cause problems in Splunk. I would do the stanzas this way: inputs.conf [monitor:///data01/oms*/active/logs/*.log] disabled = 0 sourcetype = log4j index = oms blacklist = .*gc.*\.log [monitor:///data01/oms*/active/logs/*gc*.log] disabled = 0 sourcetype = sun_jvm index = jmx props.conf [source::/data01/app/oms-holiday-adapter/current/logs/oms-holiday-adapter2.log] disabled = 0 sourcetype = log4j [source::/data01/app/oms-client-account-adapter/current/logs/oms-client-account-adapter.log] disabled = 0 sourcetype = log4j This simplifies your input.conf. Remember that props.conf can override inputs.conf settings. ... View more

I agree with dgrubb and renems - to avoid bucket conflict, you should turn on indexer acknowledgment on your forwarders and queue the data there while you make the move. See Protect against loss of in-flight data in the Forwarding Data manual. When you make the move, follow the procedure in the Managing Indexers and Clusters of Indexers manual: Move the index database. ... View more

Thank you for your answer, but I copied the pySDEE.py file but did not work, is there something else I need to modify. ... View more

According to the Docs, you need to use a Heavy Forwader to use Syslog Routing: Syslog data You can configure a heavy forwarder to send data in standard syslog format. The forwarder sends the data through a separate output processor. You can also filter the data with props.conf and transforms.conf. You'll need to specify _SYSLOG_ROUTING as the DEST_KEY. Doc link: http://docs.splunk.com/Documentation/Splunk/6.3.1/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data ... View more

Have you verified that the WinEventLog: Application input stanza is configured to translate: e.g. [WinEventLog:Application] evt_resolve_ad_obj = 1 inputs.conf.spec: evt_resolve_ad_obj = [1|0] * How the input should interact with Active Directory while indexing Windows Event Log events. * If you set this setting to 1, the input resolves the Active Directory Security IDentifier (SID) objects to their canonical names for a specific Windows Event Log channel. * If you enable the setting, the rate at which the input reads events on high-traffic Event Log channels can decrease. Latency can also increase during event acquisition. This is due to the overhead involved in performing AD translations. * When you set this setting to 1, you can optionally specify the domain controller name or dns name of the domain to bind to with the 'evt_dc_name' setting. The input connects to that domain controller to resolve the AD objects. * If you set this setting to 0, the input does not attempt any resolution. * Defaults to 0 (disabled) for all channels. ... View more