I ordered my new license, but I haven't received it yet. Who should I contact? My account manager told me that the order has already processed. ... View more

I got license violation and I received a reset key from Splunk Support. The reset key comes with the instruction in the email, but it is via UI. How to use command line to apply reset key? ... View more

How to update portal admin if he/she no longer works in my company? ... View more

How to request to re-consolidate licenses from Splunk Support? ... View more

As an enterprise customer, how can I add more authorized contacts for my company? ... View more

We have configured Splunk 4.2.2 running on Windows Server 2008 R2 with a coldPath pointing to a volume ("cold") hosted on a CIFS network drive. Contents of indexes.conf : #Volume Definition [volume:cold] path = \\sjc-vault\SplunkArchive\splunk01 maxVolumeDataSizeMB = 1000000 ################################################################################ # index definitions ################################################################################ [main] coldPath = volume:cold\defaultdb\colddb [history] coldPath = volume:cold\historydb\colddb [summary] coldPath = volume:cold\summarydb\colddb [_internal] coldPath = volume:cold\_internaldb\colddb [_audit] coldPath = volume:cold\audit\colddb [_thefishbucket] coldPath = volume:cold\fishbucket\colddb [_blocksignature] coldPath = volume:cold\blockSignature\colddb However, we get errors on startup for every index with a cold path set to the remote network drive: In handler 'indexes': Unable to load index configuration: In index '_internal': Failed to create directory '\\sjc-vault\SplunkArchive\splunk02\_internaldb\colddb' (Cannot create a file when that file already exists. We are using a domain account to run splunkd. This account has full rights to the shares and folders, therefore this should not be a permission issue. Any advice is appreciated! ... View more

In $SPLUNK_HOME/etc/apps/search/metadata/meta.local [] access = read : [ admin, can_delete, developer, power, user ], write : [ admin, power ] export = none version = 4.2.1 What does this [] mean? ... View more

In my inputs.conf, I have: [monitor://cust/http*/web-*/var/log/modsec-audit.log*] [monitor://cust/http*/web-*/var/log/*access.log*] [monitor://cust/jboss-as*/server/app-*/log/server.log] Why did I get these errors: 08-19-2011 01:02:15.148 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/view.1. 08-19-2011 01:02:15.149 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/vim.1. 08-19-2011 01:02:15.151 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/vimdiff.1. 08-19-2011 01:02:15.153 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/vimtutor.1. 08-19-2011 01:02:15.155 +0000 ERROR TailingProcessor - Unable to resolve path for symlink: /cust/soe/usr.bak.2010-10-19T051247/man/it/man1/xxd.1. I didn't ask Splunk to monitor /cust/soe/ directories. ... View more

In Splunk 4.1.4 ***What happened: tried to run the PCI 1.1.1 Network Changes report but it fails stating that eventtype=snmpd_network_down and eventtype=linux-password-change are missing. In investigating the issue, noticed the following. tag=eventtype::network - Missing are eventtype=fschange_add_network, eventtype= fschange_modify_network, and eventtype=snmpd_network_down tag=eventtype::modify - Missing are eventtype=auditd_modify, eventtype=configuration-change, eventtype=linux- password-change and linux-password-change-failed tag=eventtype::configuration - Missing eventtype=configuration-change tag=eventtype::policy - Is missing ***What is found: It seems that those eventypes are all located at $SPLUNK_HOME/etc/apps/unix/default/eventtypes.conf. They are under UNIX app. ***Questions: How do I know which eventtypes needs to be defined under the PCI App? Or do I have to define all of them? Once I know which ones, what the best way to do this? ... View more

After ran a diag for UniversalForwarder/LightWeightForwarder, found that var/lib/splunk/fishbucket/db is empty. Anything is not right? ... View more

Attempting to run ./splunk diag has failed with the following error: ================================================================ [splunk@fugaku]bin$ ./splunk diag Ensuring clean temp dir... Selected diag name of: diag-fugaku-2011-06-30 Starting splunk diag... Copying Splunk configuration files... Copying Splunk log files... Copying index worddata, and bucket info files... An unforeseen error occurred: Exception: , Value: global name 'src_path' is not defined Traceback (most recent call last): File "/san/splunk/prod/splunk/lib/python2.6/site-packages/splunk/clilib/cli.py", line 1082, in main parseAndRun(argsList) File "/san/splunk/prod/splunk/lib/python2.6/site-packages/splunk/clilib/cli.py", line 930, in parseAndRun retVal = cList.getCmd(command, subCmd).call(argList, fromCLI = True) File "/san/splunk/prod/splunk/lib/python2.6/site-packages/splunk/clilib/cli.py", line 264, in call return self.func(args, fromCLI) File "/san/splunk/prod/splunk/lib/python2.6/site-packages/splunk/clilib/control_api.py", line 33, in wrapperFunc return func(dictCopy, fromCLI) File "/san/splunk/prod/splunk/lib/python2.6/site-packages/splunk/clilib/info_gather.py", line 625, in pclMain return main() File "/san/splunk/prod/splunk/lib/python2.6/site-packages/splunk/clilib/info_gather.py", line 589, in main copy_indexfiles(get_results_dir()) File "/san/splunk/prod/splunk/lib/python2.6/site-packages/splunk/clilib/info_gather.py", line 368, in copy_indexfiles copy_file_with_parent(src_file, dest_file) File "/san/splunk/prod/splunk/lib/python2.6/site-packages/splunk/clilib/info_gather.py", line 326, in copy_file_with_parent logger.warn(err_msg % (src_path, dest_file, e.strerror)) NameError: global name 'src_path' is not defined Please file a case online at http://www.splunk.com/page/submit_issue ... View more