I got similar messages when using a configmap and mounting it to /opt/splunk/etc/system/local in my pods. I ended up adding my deployment.conf file to the container, and making deployment apps for the rest of the config. ... View more

Hey try adding this. It should extract the "aggregator" name from the original field, and then you do a simple stats count on the new field. | rex field=myfield ".+\.(?<newfield>.+)\." | stats count by newfield ... View more

This guy has the right answer here: https://answers.splunk.com/answers/242855/mvcombine-ignores-specified-delimiter-1.html In short, your search needs to move the delim parameter to your stats command, like this. source=/var/log/secure "pam_unix(sshd:session): session opened" | stats delim="," values(user) as "user" by host | mvcombine user ... View more

Any ideas when this will be corrected? ... View more

I'm having a problem with this as well. After I push the bundle, I see my connections and identities in the GUI. However, I get username/password error on all of the connections I have set up when I try to validate them. I tried plain text passwords in my identities.conf file, but they did not encrypt after I pushed the bundle and restarted my search heads. I also tried leaving the encrypted passwords from my test setup, and they gave the same username/password error. If I enter the password in each individual GUI, I can validate my connections. So it seems to just be something with the passwords in identities.conf on each search head. ... View more

I'm running clustered indexers on 6.0 and I'm seeing this same problem. Not sure what to do 05-02-2014 13:39:15.031 -0400 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/anpl/bin/timemod.pl" /bin/sh: /opt/splunkforwarder/etc/apps/anpl/bin/timemod.pl: Permission denied I tried to chown the script to splunk:splunk, where it was root:root before. Still getting the error. ... View more