Use msiexec /i .... /l*vx logfile.txt and look for "value 3" in that file. Just above that will show more information about the installation failure. ... View more

Splunk-MonotorNoHandle.exe is a modular input. It is designed to monitor live IO writes to files without opening a Windows File Handle.  It can be configured by adding a stanza to etc\local\inputs.conf. If it has not been configured, it will by default, start-up and run it's introspection every 60 seconds. It can be disabled complete (i.e. never run) by setting its default stanza with the following keys: run_introspection = false disabled = true ... View more

The syntax for Windows event log stanza is: [WinEventLog://<channel-name>] ... View more

Also the error 0x20 can be decoded here:  https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ldap/return-values   It means "no such object"  ... View more

The docs say "fully qualified" A fully qualified Lightweight Directory Access Protocol (LDAP) name (for example: "LDAP://OU=Computers,DC=ad,DC=splunk,DC=com") that specifies where in the AD tree that Splunk Enterprise begins its indexing. The software starts there and enumerates down to sub-containers, depending on the configuration of the monitorSubtree setting. The value of startingNode must be within the scope of the DC you are targeting for Splunk Enterprise to get AD data.     ... View more

There is something in your inputs.conf file that is a bad regex. Can you post your inputs.conf? ... View more

In the cases of most modular inputs, interval is not what you think it is. Interval is how often to restart the mod input if it exits, either on purpose or on error/crash. For the registry monitor -- it runs continuously. There is a driver component and a usermode component. The driver monitors the registry for the key(s)/subkeys requested in the stanza (and by operation). The usermode component pulls that information from the driver. If you are getting too much data, maybe you are requesting too broad a collection to monitor. The registry is heavily used by everything in a windows OS. ... View more

So I can drop the JMX polling app (the mod input) once I can get the agent working? Sounds good. The java agent, with the byte code injection/tracing is where I want to end up. ... View more

I did not alter the jmx.xml file. Nothing in the instructions indicated I should mess with it for an out-of-the-box installation. I think that problem #1 is what is holding things back -- because even if #2 were true (i.e. not hitting any of the classes/methods) , my app would be generating output, but does not. The symptom looks like my app doesn't even run at all and hangs. When using just the monitor the JVM app (https://splunkbase.splunk.com/app/668/), my application runs and generates data, and the monitoring app does poll data from the JVM. Can your two apps be running at the same time? (i.e. the agent & the JMX monitoring?) ... View more

log file: ((changed the extension to satisfy the upload constraints)) link text properties file: ((changed the extension to satisfy the upload constraints)) link text CLI: java.exe -Dcom.sun.management.jmxremote.port=9999 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -javaagent:splunkagent.jar=splunkagent.properties -jar C:\wrk\git\simdata\build\libs\simdata-1.0-alpha.jar --scene C:\wrk\git\simdata\demo\src\main\resources\app-management-simple.json --simulation C:\wrk\git\simdata\demo\src\main\resources\app-management-simple.simulation ... View more

Anand: Would you like to follow up on your issue directly? ... View more

There are definitely some tweaks that will be necessary. I ran through some of the overview dashboards, with the following results: Bandwidth overview: all 3 panels show "no results found" Home network overview: my public IP: 0.0.0.0, Total Events and inbound events show data, as does devices on the network (5) .. but that seems wrong. I got many many devices on the network :-). All other panels say "no results found". Check for intrusions: none (that might be right ;-)). Blocked traffic: Only the top ports request panel shows data, all other panels say, "no results found" network event overview: shows a graph of my two subnets, all other panels say, "no results found" Network inbound: has all panels reporting data! Network outbound: all panels say, "no results found". I didn't try the device specific/experimental/etc... ... View more

Here is a sample using the windows specific modular input splunk-winevtlog.exe's .conf file: [default] host = Win2k8sup04 [WinEventLog] _meta= global::fromUF-master [WinEventLog://System] disabled = 0 _meta= test::SystemUF [WinEventLog://Security] disabled = 0 [WinEventLog://Application] disabled = 0 _meta= test::ApplicationUF global::fromUF The behavior in this example is: The System stanza gets only one field test (it overrides the default). The Security stanza gets only one field global (as set by default) The application stanza gets both fields test and global (it overrides the default). ... View more

First, let us point out that in your example, you have both a "legacy" blacklist (only event code or code ranges), and two regex blacklists. To interpret the processing of blacklists is as follows: A blacklist key gets evaluated to produce a 1 or 0. In the case of the legacy blacklist line, an event code is compared to the event code or event code ranges. If it matches an event code or falls into one of the ranges of event code, then blacklist line is computed as 1, otherwise 0. In the case of the regex blacklist line, all terms are AND'ed together to compute the value of the blacklist line; if all terms match all regexes, then the blacklist line is computed as 1. If ANY regex fails, the entire blacklist line is computed as 0. Splunk will process each blacklist line in order. If any of the blacklist lines is computed as 1, we stop there and toss out the event. As a programmer, one can consider them OR'd -- and with the optimization that once we find ONE blacklist line that computes 1, Splunk doesn't need to process any more blacklists, because once blacklisted, the event is gone. Pro tip: make the blacklists that remove the largest amount of events have lower numbers (e.g. blacklist1, blacklist2 ...) ... View more

I don't see, "return value 3" anywhere in this. This might help you figure out specifically which action is failing or help you help us figure out what is wrong: https://technet.microsoft.com/en-us/library/cc535232.aspx ... View more

How about grabbing the 30 lines or so before the first "Return value 3"? ... View more

That's the right command. And now, what do we have in the log file? ... View more

Hmmmm. Can I ask you to try one more thing? Execute the following command (the logging is still very sparse and not sure why): $ msiexec /i (path-to-msi) /l*v (path-to-logfile) ... View more

That portion of the MSI installation log does not contain enough information to be useful. For example, which action was executed? Would you be able to enable MSI debugging: http://support.microsoft.com/kb/223300 -- and rerun the installation? ... View more

If you don't mind filtering at the source, you can use the blacklist feature on the windows event log modular input. ... View more

You can check the %temp% directory of the user that installed splunk and look for a MSIxxxxxxx.log file. If you have many of them -- look for the one that installed splunk. If you cannot find it, you can explicitly create an install log file with the following cli command: $ msiexec /i /l*v The Microsoft MSI installer subsystem will create a log file there. Once created we can crack it open and look to see what is going on. ... View more