For AWS credentials if you have "+" in your secret key this api call won't work. The solution which I did is to create a new secret key that doesn't have a '+' special character in it. ... View more

The queue was setup but because python-boto 2.5 was unable to see the ap-southeast-2 region It was returning None instead of the queue that I created. Cheers Walmc for the information, I'm not really a python programmer so the info you gave me got me started on the right track. ... View more

I'm having the same problem between my deployment server and index cluster. If I remove all the files and directories starting with my deployment server's name from $SPLUNK_HOME/var/run/searchpeers it recovers with no need to restart, Splunk 7.0.3 (build fa31da744b51). ... View more

hi michaeloleary you could use the same btool from S.o.S. for this, it is a python script in etc/apps/sos/bin/ called btool.py. Copy it to etc/apps/<yourapp>/bin and add btool.py to commands.conf in etc/apps/<yourapp>/default/ . After that you can run the following query to get the inputs on your splunk: | btool inputs hope this helps cheers, MuS ... View more

Hi, Thanks for the replies and the time taken for this.Currently I chceck the licensing and if any violations. Also to make sure designated end points are sending the logs through I am checking the indexes under the manager so it shows current date and time for the updates it has done. That way I know indexing is fine. How do I do a Splunk backup? Since my installation a windows one can I do a net backup using any other external tools? Thatway It includes the Splunk config and indexes as well? I am planning to create dashboard for each and every end point that I am monitoring currently. [there are about 15] So that way I can see what's working and what's not sending logs through at a glance. Do you guys have any other ideas that can help me. Surely I will have a look at deployment monitor and Splunk app as well. Thanks Indikaw ... View more

Docs updated. ... View more

Upgrading Splunk to 4.3.4 should solve the issue ... View more

Excuse the delay in getting back to you in a timely fashion, that works perfectly. I knew I had to use either Multi-line or Single line options but I couldn't get the syntax quite right. Thanks for your help. ... View more

Event hashing been deprecated since Splunk 5.0, but the good news is that Splunk 6.3 has released the latest feature called Data Integrity which replaces Event Hashing. The new Data Integrity feature supports both distributed search and cluster configurations. Here is a blog post for more in depth information regarding the new Data Integrity feature: http://blogs.splunk.com/2015/10/28/data-integrity-is-back-baby/ Splunk Documentation on how to enable Data Integrity http://docs.splunk.com/Documentation/Splunk/6.3.0/Security/Dataintegritycontrol ... View more

Perfect! Thank you very much. Worked a treat. ... View more