answering to myself : I've manually restarted splunk service on each indexer. Error messages have disappeard right now but it took a while event after restart. It looks like restarting the service is what makes the counter revert to zero but I'm not completely sure how this works... ... View more

As of 2018 the Managing Indexers and Clusters of Indexers : Additional roles for the master node now definitively says No quote: Additional roles for the master node &nbsp As a general rule, you should dedicate the Splunk Enterprise instance running the master node to that single purpose. Under limited circumstances, however, the master instance can also fulfill certain other lightweight functions . . . . . . snip . . . &nbsp !!! Caution: Do not colocate a deployment server on the master under any circumstances. ... View more

Ok! Sounds like web.conf might be the right file for these settings. Let me know if, after adjusting more of the settings in web.conf, you aren't able to get the right configuration. It's also possible to open a support ticket for more troubleshooting. Also, you might have already seen this, but just FYI: this older post went into a lot of detail on a reverse proxy configuration and addressed some differences in software versions 5 and 6: http://answers.splunk.com/answers/72512/reverse-proxy-not-working-configuration-even-with-expected-config.html All best, @frobinson_splunk ... View more

Great thanks guys. i had a few errors in my lookup table that caused some weird results. All good now. I have used this before as my guide: search | lookup [lookup definition name] [fieldname1 in lookup table to check] as [fieldname2 in events] OUTPUT [ fieldname3 in lookuptable ] as [fieldname4 - you can create a new name] | search [fieldname4]=”*” couldn't understand why it wasn't working this time! ... View more

tested on another splunk instance and doesn't seem limited this time testcase * | stats dc(dest_ip) as countip,values(dest_ip) | sort limit=1 - countip have more than 8000 results csv file is two lines header one 123000 length line -> good the one with the pb has many parameters set -> still trying to find which one manage this ... View more

All of a sudden in 6.6.X you cannot put the base search in the same location as in rsennett's example. This is particularly annoying because if you do it from the filesystem there are no problems. ... View more

One should not run Splunk (or anything not part of the OS) as root. ... View more

First try disabling the firewall. if not then ask your network team to look into it telnet IP_Add 8089 it has to be successful to make it work further ... View more

Thanks for follow up. I did the same. ... View more

Thanks. From the comments in the first post, it seems that it is a missing feature at this time. BTW, I don't want to modify code and changing the locale for all users. I find it good to have interface localized for users whishing to be in their main language. ... View more

Thanks had saw them. In my case, i'm effectively logged in but it is not very user friendly. ... View more

Hi, After configure site=site0 in server.conf all the search head says error invalid site. Is needed other configuration to disable search affinity? Thanks, ... View more

I've got the same problem (black page with no message) with 6.2 behind a Checkpoint vpnssl in web portal mode.(Firefox browser used) No problem accessing directly or in tunnel mode via vpnssl. I don't know if it worked with previous splunk versions. I'm not using https on splunk on this instance so this is not the problem.(url=http://ip:8000/) I can see some splunk code rewritten by the vpnssl in the source code so the vpnssl is reaching splunk. Anybody could access a splunk instance through a Checkpoint vpnssl ? ... View more

I am just getting started with EventGen myself. This would be a sweet addition to this tool, but as of yet doesn't seem to be possible the way you wish. From : [sample filename] * This stanza defines a given sample file contained within the samples directory. * This stanza can be specified as a PCRE. * Hardcoded to $SPLUNK_HOME/etc/apps/ /samples/ . * This stanza is only valid for the following replacementType -> replacement values: * static -> <string> * timestamp -> <strptime> * replaytimestamp -> <strptime> * random -> ipv4 * random -> ipv6 * random -> mac * random -> integer[<start>:<end>] * random -> float[<start.numzerosforprecision>:<end.numzerosforprecision>] * random -> string(<integer>) * random -> hex([integer]) * rated -> integer[<start>:<end>] * rated -> float[<start.numzerosforprecision>:<end.numzerosforprecision>] * file -> <replacment file name> * mvfile -> <replacement file name, expects CSV file>:<column number> disabled = true | false * Like what it looks like. Will disable event generation for this sample. I suspect you will just want to do what most people seem to do for this issue, just use the file replacement and generate a list of pseudo random IP addresses. The samples (and README) directory in the SA-EventGen app does have some excellent examples. ... View more

I've got the same pb here. 10 minutes delay during parsing phase for any schedule or adhoc search (except if it's directly |), even when it should be low hour usage. the server is loaded and does too much things but this doesn't explain the behaviour and what I should monitor. splunk version is 6.2.2 , linux 64 bit, 8 core this looks to me like there's some queue limit somewhere. Any idea where to look for ? (every search included on splunk logs is delayed so it's slow to debug...) ... View more

In the schedule you can do run every hours/days/weeks.... and there is any optino run on cron schedule that is where you can make the report trigger in next min ... View more

Given the change of state, I unaccepted my prior answer (that was years old) and marked ogdin's as correct. ... View more