Hi @codebuilder Above you say: "Also, check the SPLUNK_SERVER_NAME setting in /opt/splunk/etc/splunk-launch.conf ... If the value is set there, comment it out and cycle Splunk. The setting there overrides what is in server.conf and causes issues." Can you clarify which setting in server.conf is overriden? Or shed any further light on what exactly is happening here? I'm trying to better understand this behavior for Splunk doc purposes. thanks! ... View more

Hi. I ran your question by the stream dev team, and received this response: The output of “service streamfwd start|stop|restart|status“ depends on the platform and also on the init system in use (Systemd, System V etc.). Typically, the output for the “service streamfwd status” is "streamfwd (pid) is running…" if streamfwd is running, or "streamfwd is stopped” if its not running.    Here for this question,  I see this - "Active: active (running) since Thu 2018-09-13 15:10:01 EDT; 3 days ago” which means streamfwd is running. I’ve filed a request to add some guidance to the Stream docs for using “service streamfwd start|stop|restart|status". For more info on the details of the output, you might also check some Linux-specific docs, such as this: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/sect-managing_services_with_systemd-services ... View more

In indexer cluster environments, the master, search heads, and all cluster peers must run on separate machines, and each machine must be using the same operating system. For more info, see: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Systemrequirements#Summary_of_key_requirements ... View more

Hi. Just FYI: The Stream REST API docs have been updated with instructions on how to generate the required tokens. See: http://docs.splunk.com/Documentation/StreamApp/7.0.1/DeployStreamApp/SplunkAppforStreamRESTAPI#How_to_generate_tokens ... View more

hi. The Splunk Stream REST API docs have been updated with new request/response examples, parameter information, etc., for each operation. To use the /streams endpoint to create, modify, and delete streams, see: http://docs.splunk.com/Documentation/StreamApp/7.0.1/DeployStreamApp/SplunkAppforStreamRESTAPI#Streams HTH. ... View more

If you suspect it is a KV store permissions issue, you might have a look at this doc which explains how to set permission to KV store collections: http://docs.splunk.com/Documentation/ITSI/2.4.0/Configure/Configureusersandroles#Set_permissions_to_KV_store_collections ... View more

You might also try reducing the total number of "every one minute" interval KPI searches that you are running (if you are running a lot). Too many 1 min. searches can have a negative impact on performance. Running KPIs at 5 min. or 15 min. intervals is enough in many cases. Also, make sure that you have adequate hardware resources (beyond the baseline Splunk reference hardware required for Splunk Enterprise). ITSI is resource intensive and can require additional hardware. For more info and some tips on ITSI performance, see: Performance considerations in the Installation and Configuration manual. ... View more

Hi. Splunk_TA_stream (aka stream forwarder) is installed with the Splunk app for Stream package. In a distributed environment you can use the deployment server to push the Splunk_TA_stream out to new forwarders or manually install the TA on forwarders. This is covered in the following doc: http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/InstallSplunkAppforStream#Splunk_App_for_Stream_components In a distributed deployment, you must install the Splunk_TA_stream on forwarders and indexers. The Stream app itself only requires installation on search heads. This is covered in the Distributed Deployment section of the Deployment Architectures documentation: http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/DeploymentArchitecture In terms of Windows installation, the process is identical to Linux/OSX, with the exception that splunkd does not require root privileges on Windows. See Install Splunk App for Stream, Step 3: http://docs.splunk.com/Documentation/StreamApp/6.3.0/DeployStreamApp/InstallSplunkAppforStream#Step_3:_Ensure_Proper_Permissions_.28Linux.2FOSX_only.29 Hope this helps. Steven ... View more

Hi. A few possibilities here: Make sure to stop the Java Bridge Server before you perform the fresh install. See this troubleshooting doc that explains the correct steps: http://docs.splunk.com/Documentation/DBX/1.1.6/DeployDBX/Troubleshoot#Problem_upgrading_from_earlier_DB_Connect_versions If you've recently updated your version of JDK, make sure that your JAVA HOME path in Settings > DB Connect Configuration specifies the correct version of JDK. See this doc for details on setting up DB Connect after install: http://docs.splunk.com/Documentation/DBX/1.1.6/DeployDBX/Installtheconnector#Setup_Splunk_DB_Connect There is also a known issue that causes this behavior and affects users with a role that inherits from the default dbx_user role (DBX-317). See this troubleshooting item for details and workaround: http://docs.splunk.com/Documentation/DBX/1.1.6/DeployDBX/Troubleshoot#The_DB_Connect_homepage_keeps_refreshing Good luck! ... View more

Hi. Make sure that the JAVA_HOME path is set correctly in the DB Connect Setup page. See http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Troubleshoot#Java_Bridge_Server_does_not_work_after_upgrading_JDK Also see these other possible causes for the Java Bridge Server not running: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Troubleshoot#Java_Bridge_Server_not_running ... View more

Hi. Make sure that you have the correct JDBC drive installed for DB2. For details on downloading and installing the DB2 driver, see Splunk documentation at: http://docs.splunk.com/Documentation/DBX/1.1.5/DeployDBX/Installdrivers ... View more

Hi Joe, If you mean using splunk as linux user login that should be fine. No permissions issues. ... View more

Hi. Would you mind posting your local/inputs.conf stanzas? It could be an incorrect stanza in local/inputs.conf. See: http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/Troubleshoot#inputs.conf_stanzas_must_match_in_default_and_local_directories. Thanks ... View more

Hi. Java 1.8.x is not compatible with DB Connect 1.1.4. Only Java1.7.x and 1.6.x are compatible with the app. DB Connect docs have been updated to clarify this: http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/Deploymentrequirements#Java_Runtime_Environment_.28JRE.29 Thanks ... View more

Another possibility: Check the dbx.log for "REST keep-alive failed" error. If this turns up restart Splunk. You also might have a stale "state.xml" file. Fix is to remove any stale state.xml files. See: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Troubleshoot#Java_bridge_log_file_settings ... View more

Hi. Did you update the JAVA HOME path inside DB Connect 1.1.4. This is a common oversight when upgrading JRE. Inside DB Connect, go to Settings > Splunk DB Connect Configuration. Then update the Java Home with the new path. For more info see: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Troubleshoot#Java_Bridge_Server_does_not_work_after_upgrading_JDK Hope this helps ... View more

Hi. You might want to have a look at these docs, which discuss best practices for timestamps and database output: http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/Configuredatabasemonitoring#About_timestamps_and_database_output ... View more

Hi Tom, You might want to have a look at this documentation about timestamps and dboutput in DB Connect: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Configuredatabasemonitoring#About_timestamps_and_database_output Make sure to review the section on "Timestamp best practices." In case you are using timestamp as rising column, it is not recommended. Also, you might want to review this Search Reference doc to make sure you are using proper syntax for the "eval" command: http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/CommonEvalFunctions ... View more

Hi. You might also want to check that your JAVA_HOME path is set to the correct version of JDK on your host. For more info and a workaround, see this troubleshooting item: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Troubleshoot#Java_Bridge_Server_does_not_work_after_upgrading_JDK ... View more

Hi. You can also try using an SQL statement in your query that converts epoch time to datetime. For example: SELECT FROM_UNIXTIME(epoch timestamp, optional output format) The default output is YYYY-MM-DD HH:MM:SS ... View more