Perhaps just use the inbuilt passwords.conf endpoint e.g. <setup> <block title="Proxy Server for API calls" endpoint="storage/passwords" entity="_new"> <input field="name"> <label>Username</label> <type>text</type> </input> <input field="password"> <label>Password</label> <type>password</type> </input> </block> </setup> ... View more

From another post - made it blank and it worked! The Group Mapping attribute in AD should be left blank, or set to "distinguishedName" or "dn". This attribute specifies what field within the user record maps to the Group Member Attribute within the group. In AD (and LDAP in general) groups are not stored on the user object, but on the group object. The AD users memberof attribute is a synthetic attribute based on the group member attribute ... View more

In case you get trapped with a file not being monitored even if (1) all permissions seem correct, (2) your deployment script is set to Enable App, Restart Splunkd and (3) You see these errors 09-18-2015 12:28:47.311 +1000 WARN FilesystemChangeWatcher - error getting attributes of path "/software/app/oracle/admin/webhost1/diagnostics/logs/OHS/ohs1/access_log": Permission denied Then I found this actually did work: - Log on to the forwarder and check that your app with the file monitoring stanza has been deployed all OK - Do a splunk list monitor (if you’ve got the same problem it won’t be listed) - Restart of splunk e.g. /opt/splunkforwarder/bin/splunk restart - Do another splunk list monitor to see if it has worked Unfortunately in this exercise I didn’t do a ps | grep splunk on the remote host to check if the splunkforwarder process had been restarted by the utility server’s splunk reload deploy-server ... View more

In case you get trapped with a file not being monitored even if (1) all permissions seem correct, (2) your deployment script is set to Enable App, Restart Splunkd and (3) You see these errors 09-18-2015 12:28:47.311 +1000 WARN FilesystemChangeWatcher - error getting attributes of path "/software/app/oracle/admin/webhost1/diagnostics/logs/OHS/ohs1/access_log": Permission denied Then I found this actually did work: - Log on to the forwarder and check that your app with the file monitoring stanza has been deployed all OK - Do a splunk list monitor (if you’ve got the same problem it won’t be listed) - Restart of splunk e.g. /opt/splunkforwarder/bin/splunk restart - Do another splunk list monitor to see if it has worked Unfortunately in this exercise I didn’t do a ps | grep splunk on the remote host to check if the splunkforwarder process had been restarted by the utility server’s splunk reload deploy-server ... View more

In case you get trapped with a file not being monitored even if (1) all permissions seem correct, (2) your deployment script is set to Enable App, Restart Splunkd and (3) You see these errors 09-18-2015 12:28:47.311 +1000 WARN FilesystemChangeWatcher - error getting attributes of path "/software/app/oracle/admin/webhost1/diagnostics/logs/OHS/ohs1/access_log": Permission denied Then I found this actually did work: - Log on to the forwarder and check that your app with the file monitoring stanza has been deployed all OK - Do a splunk list monitor (if you’ve got the same problem it won’t be listed) - Restart of splunk e.g. /opt/splunkforwarder/bin/splunk restart - Do another splunk list monitor to see if it has worked Unfortunately in this exercise I didn’t do a ps | grep splunk on the remote host to check if the splunkforwarder process had been restarted by the utility server’s splunk reload deploy-server ... View more

In case you get trapped with a file not being monitored even if (1) all permissions seem correct, (2) your deployment script is set to Enable App, Restart Splunkd and (3) You see these errors 09-18-2015 12:28:47.311 +1000 WARN FilesystemChangeWatcher - error getting attributes of path "/software/app/oracle/admin/webhost1/diagnostics/logs/OHS/ohs1/access_log": Permission denied Then I found this actually did work: - Log on to the forwarder and check that your app with the file monitoring stanza has been deployed all OK - Do a splunk list monitor (if you’ve got the same problem it won’t be listed) - Restart of splunk e.g. /opt/splunkforwarder/bin/splunk restart - Do another splunk list monitor to see if it has worked Unfortunately in this exercise I didn’t do a ps | grep splunk on the remote host to check if the splunkforwarder process had been restarted by the utility server’s splunk reload deploy-server ... View more

<form> <label>Detailed License Summary</label> <fieldset submitButton="false" autoRun="true"> <input type="time" searchWhenChanged="true" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <title>License Usage by Day - Last 7 Days</title> <search> <query>index=_internal source=*license_usage.log type=Usage earliest=-7d| eval GB=b/1024/1024/1024 |timechart span=1d sum(GB) as "Total GB Used"</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> <panel> <table> <title>License Usage by Sourcetype</title> <search> <query>index=_internal source=*license_usage.log type=Usage | stats sum(b) AS bytes by st | eval MB= round(bytes/1024/1024,1) | fields st MB | rename st as Sourcetype | sort -MB</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> <row> <panel> <table> <title>License Usage by Source</title> <search> <query>index=_internal source=*license_usage.log type=Usage | stats sum(b) AS bytes by s | eval MB= round(bytes/1024/1024,1) | fields s MB | rename s as Sourcetype | sort -MB</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> <panel> <table> <title>License Usage by Host</title> <search> <query>index=_internal source=*license_usage.log type=Usage | stats sum(b) AS bytes by h | eval MB= round(bytes/1024/1024,1) | fields h MB | rename h as host | sort -MB</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> ... View more