Check if you were getting this error before configuring SSL. I get this error on all hosts, and I don't believe that it's related to SSL. In short, I think that you can ignore this. ... View more

Sorry for the delay, I was thinking it might be something like that. Making those changes resolved the issue. Thanks! ... View more

Interesting. So to be clear, in your experience, there is no way to retroactively create hashes for a journal? ... View more

According to the system requirements FreeBSD is supported for the Universal Forwarder, but there doesn't appear to be a v8.1 package for it. The latest FreeBSD Universal Forwarder package is currently 8.06, which can be found on the Older Splunk Universal Forwarder Releases page.   https://www.splunk.com/en_us/download/previous-releases/universalforwarder.html#tabs/freebsd ... View more

In general ML can do this, however the data you are describing is very discrete. For example, both Workers and Roles have a paygrade, but learning something about this can be prove challenging for an ML algorithm. A new worker might not have the exact same paygrade as a previous worker, so creating a new feature which calculates the difference between the paygrade of the role and the worker is more beneficial. Worker/Role combination with a higher paygrade difference might be more likely to succeed. It is similar to how you would evaluate it yourself. Having features that are easily comparable to each other helps the algorithm learn. I think what you want as an input is a worker/role combination including their attributes and maybe some extra feature like the one I mentioned. As output you should get a success/failure condition, possibly with a confidence value for how likely the answer is. That way you can train it using the same information. ... View more

Upvoted for including the "untable" command, which turned out to be exactly the function I needed. ... View more

Just finished a rolling restart and no errors anymore after increasing the timeout to 30mins. Thank you both for the assistance! ... View more

@hmallett, There might two possibilities in your case. You always want the results of saved search to be appended to lookup. In this case you can use append=true with outputlookup command. In another case you sometimes require to update the lookup based on some field. By this what I mean is you might have some unique field in the lookup and if same value pops up from the search you want to update the row in the lookup instead of appending new row. In this case you can create kv-store lookup and make the unique value as a key in kvstore lookup . You can find more about kvstore lookup, just google it. Hope this helps!!! ... View more

Or v8.4 for that matter ... View more

The Troubleshooting Manual has a specific section on event indexing delays, which includes identifying the cause. http://docs.splunk.com/Documentation/Splunk/6.5.3/Troubleshooting/Troubleshootingeventsindexingdelay ... View more

I do not find this answer acceptable. It is a royal pain to have to click twice on every single knowledge object to change the same setting. Due to our users creating dangerous dashboards for splunk performance, we are forced to control the privileges for every single knowledge object they create. As a result I spend so much time just changing permissions on sometimes more than 50 objects. It's ridiculous. And this is only talking about permissions. What about enabling, disabling, moving, deleting? One should be able select them and apply the same setting to all selected KO with just one click. This is what I call "intuitive GUI design". Furthermore, I am writing this today October 4th, 2017, and this was asked in 2012, so 5 years later and still nothing done to improve this. I saw at the conference in 2016 someone demonstrating what I just described, but for some mysterious reason, it never made it in the last version. I would love to know why. ... View more