We have a partner who wants an extremely light interface to send data into a Splunk instance. They prefer to make a simple REST call directly from the browser to load a JSON payload into Splunk. The goal is to NOT have a heavy server-side process, but rather a lightweight REST interface directly to Splunk. The data would be keyed on the user working in the browser at the time of the call out. The data would be accessed in a Splunk dashboard/report keying on the user and his/her data. I saw a recommendation from another post regarding HTTP Event Collector for this purpose. On first thought this seems feasible, but I am interested in knowing the pluses and minuses of both solutions. Regards. ... View more

Splunk searches return hostname by default -- where hostname is the value returned the linux command hostname. We have a partner whose VMs get refreshed frequently where the underlying ip changes, but the alias remains constant. What is the best way to have Splunk report the primary alias rather than the linux hostname? Regards. ... View more

I just repaired corrupt buckets for a partner index on one of our enterprise indexers. The issue only became apparent after the customer saw the warnings on their reports. My question is: are there easy proactive warnings the administrators can receive highlighting index bucket corruption -- rather than leaving it up to our customers to find the problems. ... View more

After upgrading from 6.3.7 to 6.5.2, we are getting the error on search: "Cannot get username when all users are selected". Some people are getting this and some aren't. We are also seeing different results for different browsers relative this error. Regards. ... View more

I am automating removing a search head (SH) instance from both the search head cluster and the index cluster. Removing the SH from the shcluster is easy, but removing the SH from the index cluster seems problematic -- assuming it is done via a CLI command and not by restarting the cluster master instance. The SH was added to the index cluster using the following command from the SH: ./splunk edit cluster-config -auth admin:${PASSWD} -mode searchhead -site ${SITE} -master_uri ${CLUSTERMSTR_URI} -replication_port 8080 -secret ${CLUSTERMSTR_PASSWD} Also from the SH, am trying to remove the SH from the index cluster using: ./splunk remove cluster-master -master_uri https://splunk-clustermstr-dev.fmrco.com:8089 -secret ${CLUSTER_PWD} result: In handler 'clustersearchheadconfig': Cannot remove this master. I also tried to run the following command from the cluster master: ./splunk remove cluster-peers -peers 8C842081-A220-4081-87AC-92915D567845 Result: In handler 'clustermastercontrol': Remove aborted, Reason: Cannot find peer with guid=8C842081-A220-4081-87AC-92915D567845 to remove. Wasn't sure why till running ./splunk list cluster-peers and saw that it is only showing indexer entries, not SH entries. I am hoping not to have to restart the cluster master instance to get rid of removed SH instances -- let me know how please. Regards. ... View more

As part of the work to upgrade all of our forwarders in our enterprise, we are also pointing forwarders to a NEW deployment server. This is done by running a bash script on each forwarder that downloads a new deployment application that contains a different deploymentclient.conf -- which points to the new deployment server URL:PORT. The version of the forwarder software is also upgraded and the forwarder restarted. All is well. However, on some forwarders, the new deployment application that replaced a deployment application of the same name is removed (I can only assume by the synchronization of the deployment server) -- though not necessarily right away; sometimes there is a delay of unknown time. We have experienced issues before with synchronization in the deployment server and the forwarders. Does this problem sound familiar? Regards. ... View more

In our current enterprise topology, we are running Splunk 6.2.1 clustered search heads and we have our utility instances (cluster master, deployer, deployment server) running on the same host as one of our search heads. Support has told us that we need to remove the deployer to a separate host so that it doesn't share with one of the search heads. My question: is it sufficient to move the deployer to a separate host, or do other of the utility instances need to be moved? Lastly, in addition to moving the deployer instance, we are looking to upgrade the search heads to v6.2.6. Which should we perform first? upgrade the sheads to v6.2.6 or move the deployer to separate host Regards, -James O'Connell. ... View more