right! i tested it from own server ... View more

Hi I see this error in mongo.log Did not find local replica set configuration document at startup; NoMatchingDocument Did not find replica set configuration document in local.system.replset ... View more

Hi, Tnx for the reply with splunk running service i see that port 8191 is listening and telnet works ... View more

Hi on other lab server it is enabled , i changed it in /opt/splunk/etc/system/default/server.conf , kvstore was disabled in one section to true [introspection:generator:kvstore] disabled = false (was true) but on other with same settiings i am get error that is not enabled. Maybe mongo db is corrupted and needs to be repaired? Tnx ... View more

Thanks.... ... View more

Hi, I see the kvstore is enabled (disabled=false) ... View more

I thought to get ssh access in order to administer the splunk server. So I will get gui access for administration tasks? ... View more

its not permissions issue i think , maybe mongo db corrupted? ... View more

Hello tnx for reply I already configured 700 permissions then reverted back to 400 with no luck. ... View more

Hey, We found the issue and here is the solution. On the Windows server, you need to configure this: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf [WinEventLog://System] disabled = 0 blacklist1 = EventCode="7036" and it works. I stopped getting events with code 7036. Tnx for your help from the beginning !!! ... View more

Hello I copied relevant folders & log and diag files, Should be ok now Here is the link below: https://www.dropbox.com/s/y6mqx2s5b058jod/splunk%20diag.rar?dl=0 ... View more

Hi Here is the link to diag file: https://www.dropbox.com/s/5eoa6k76ensc6iv/diag-splunk-102-2016-01-06_16-59-07.tar.gz?dl=0 Tnx in advance! ... View more

Hi , can you please reproduce this issue by yourself in lab? ... View more

Hi I tried your last suggestion with the white list, with no luck.. ... View more

Tnx for quick reply, really appreciate it!! the inputs.conf exists in /opt/splunk/etc/system/local/ [root@splunk-102 local]# vi inputs.conf [default] host = splunk-102 [splunktcp://9997] [WinEventLog://System] disabled = 0 whitelist = 7036-7037 [WinEventLog://Security] disabled = 0 blacklist = 4726 ... View more

I still get this error not sure if it can affect the event log filtering Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/app.conf, line 14: attribution_link (value: app.attributions). ... View more

Hello I installed new splunk and new UF here is the btool output: [root@splunk-102 ~]# /opt/splunk/bin/splunk btool check --debug Checking: /opt/splunk/etc/users/admin/search/local/ui-tour.conf Checking: /opt/splunk/etc/users/admin/user-prefs/local/user-prefs.conf Checking: /opt/splunk/etc/apps/learned/local/props.conf Checking: /opt/splunk/etc/apps/search/local/indexes.conf Checking: /opt/splunk/etc/apps/search/local/serverclass.conf Checking: /opt/splunk/etc/apps/SplunkForwarder/default/app.conf Checking: /opt/splunk/etc/apps/SplunkForwarder/default/default-mode.conf Checking: /opt/splunk/etc/apps/SplunkForwarder/default/outputs.conf Checking: /opt/splunk/etc/apps/SplunkForwarder/default/server.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/app.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/default-mode.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/indexes.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/inputs.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/limits.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/outputs.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/props.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/server.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/web.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/app.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/authorize.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/distsearch.conf No spec file for: /opt/splunk/etc/apps/Splunk_TA_windows/default/eventgen.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/eventtypes.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/indexes.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/inputs.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/macros.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/props.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/tags.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/transforms.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/web.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/wmi.conf Checking: /opt/splunk/etc/apps/Splunk_TA_windows/default/workflow_actions.conf Checking: /opt/splunk/etc/apps/alert_webhook/default/alert_actions.conf Checking: /opt/splunk/etc/apps/alert_webhook/default/app.conf Checking: /opt/splunk/etc/apps/alert_webhook/default/restmap.conf Checking: /opt/splunk/etc/apps/appsbrowser/default/app.conf Checking: /opt/splunk/etc/apps/gettingstarted/default/app.conf Checking: /opt/splunk/etc/apps/introspection_generator_addon/default/app.conf Checking: /opt/splunk/etc/apps/introspection_generator_addon/default/inputs.conf Checking: /opt/splunk/etc/apps/introspection_generator_addon/default/server.conf Checking: /opt/splunk/etc/apps/launcher/default/app.conf Checking: /opt/splunk/etc/apps/launcher/default/launcher.conf Checking: /opt/splunk/etc/apps/legacy/default/app.conf Checking: /opt/splunk/etc/apps/legacy/default/props.conf Checking: /opt/splunk/etc/apps/sample_app/default/app.conf Checking: /opt/splunk/etc/apps/sample_app/default/indexes.conf Checking: /opt/splunk/etc/apps/sample_app/default/inputs.conf Checking: /opt/splunk/etc/apps/sample_app/default/props.conf Checking: /opt/splunk/etc/apps/search/default/app.conf Checking: /opt/splunk/etc/apps/search/default/commands.conf Checking: /opt/splunk/etc/apps/search/default/event_renderers.conf Checking: /opt/splunk/etc/apps/search/default/macros.conf Checking: /opt/splunk/etc/apps/search/default/props.conf Checking: /opt/splunk/etc/apps/search/default/restmap.conf Checking: /opt/splunk/etc/apps/search/default/savedsearches.conf Checking: /opt/splunk/etc/apps/search/default/transforms.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/app.conf Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/app.conf, line 14: attribution_link (value: app.attributions). Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/authorize.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/collections.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/distsearch.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/eventtypes.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/indexes.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/macros.conf No spec file for: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/msftapps_winfra_setup.conf No spec file for: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/paletteinputs.conf No spec file for: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/palettepalettes.conf No spec file for: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/palettepanels.conf No spec file for: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/palettesearches.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/props.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/restmap.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/savedsearches.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/server.conf No spec file for: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/splunk_msftapp.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/tags.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/transforms.conf Checking: /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/web.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/app.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/commands.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/distsearch.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/props.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/savedsearches.conf Checking: /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf Checking: /opt/splunk/etc/apps/splunk_management_console/default/app.conf Checking: /opt/splunk/etc/apps/splunk_management_console/default/distsearch.conf Checking: /opt/splunk/etc/apps/splunk_management_console/default/macros.conf Checking: /opt/splunk/etc/apps/splunk_management_console/default/props.conf Checking: /opt/splunk/etc/apps/splunk_management_console/default/savedsearches.conf Checking: /opt/splunk/etc/apps/splunk_management_console/default/splunk_management_console_assets.conf Checking: /opt/splunk/etc/apps/splunk_management_console/default/transforms.conf Checking: /opt/splunk/etc/apps/user-prefs/default/app.conf Checking: /opt/splunk/etc/apps/user-prefs/default/user-prefs.conf Checking: /opt/splunk/etc/system/default/alert_actions.conf Checking: /opt/splunk/etc/system/default/app.conf Checking: /opt/splunk/etc/system/default/audit.conf Checking: /opt/splunk/etc/system/default/authentication.conf Checking: /opt/splunk/etc/system/default/authorize.conf Checking: /opt/splunk/etc/system/default/collections.conf Checking: /opt/splunk/etc/system/default/commands.conf No spec file for: /opt/splunk/etc/system/default/conf.conf Checking: /opt/splunk/etc/system/default/crawl.conf Checking: /opt/splunk/etc/system/default/datamodels.conf Checking: /opt/splunk/etc/system/default/datatypesbnf.conf Checking: /opt/splunk/etc/system/default/default-mode.conf Checking: /opt/splunk/etc/system/default/distsearch.conf Checking: /opt/splunk/etc/system/default/event_renderers.conf Checking: /opt/splunk/etc/system/default/eventdiscoverer.conf Checking: /opt/splunk/etc/system/default/eventtypes.conf Checking: /opt/splunk/etc/system/default/fields.conf Checking: /opt/splunk/etc/system/default/indexes.conf Checking: /opt/splunk/etc/system/default/inputs.conf Checking: /opt/splunk/etc/system/default/limits.conf Checking: /opt/splunk/etc/system/default/multikv.conf Checking: /opt/splunk/etc/system/default/outputs.conf Checking: /opt/splunk/etc/system/default/pdf_server.conf No spec file for: /opt/splunk/etc/system/default/prefs.conf Checking: /opt/splunk/etc/system/default/procmon-filters.conf Checking: /opt/splunk/etc/system/default/props.conf Checking: /opt/splunk/etc/system/default/restmap.conf Checking: /opt/splunk/etc/system/default/savedsearches.conf Checking: /opt/splunk/etc/system/default/segmenters.conf Checking: /opt/splunk/etc/system/default/server.conf Checking: /opt/splunk/etc/system/default/serverclass.conf Checking: /opt/splunk/etc/system/default/source-classifier.conf Checking: /opt/splunk/etc/system/default/times.conf Checking: /opt/splunk/etc/system/default/transactiontypes.conf Checking: /opt/splunk/etc/system/default/transforms.conf Checking: /opt/splunk/etc/system/default/ui-prefs.conf Checking: /opt/splunk/etc/system/default/ui-tour.conf Checking: /opt/splunk/etc/system/default/viewstates.conf Checking: /opt/splunk/etc/system/default/web.conf Checking: /opt/splunk/etc/system/default/workflow_actions.conf Checking: /opt/splunk/etc/system/local/inputs.conf No spec file for: /opt/splunk/etc/system/local/migration.conf Checking: /opt/splunk/etc/system/local/server.conf ... View more

Hey, when i moved the TA directory i was unable to get any events so i moved it back i tried to config the inputs.conf in TA dir but still not working. what about set another splunk instance and configure heavy forwarder? ... View more

Hello, I mean server classes (define windows event logs source like : Security,System,Application) did it , here is new output https://www.dropbox.com/s/l4hd34w768ipqol/new%20btool%20output.txt?dl=0 ... View more

Hello , i performed the correction to the blacklist = 4726 , but still able to see the event in splunk i removed the server class-system & security and now unable to see system & security events. Is there no way to config input.conf to see events without server classes? Tnx ... View more

Hi here is the relevant output https://www.dropbox.com/s/l4hd34w768ipqol/new%20btool%20output.txt?dl=0 ... View more

Here is the new btool output Tnx https://www.dropbox.com/s/l4hd34w768ipqol/new%20btool%20output.txt?dl=0 ... View more

Hello , i performed it but still no result ... View more