Hi 🙂 Dears, I am using Splunk 6.4 as a heavy forwarder which send its logs to an indexer (6.3) . Heavy forwarder has MySQL add-on installed on it. While trying to search indexed data, I got the error below that my license expired or has been violated, despite still having not indexed any data or expiration date hasn't come! please advise ? Thanks ... View more

Hi 🙂 I have read Splunk MySql docs, but I have a question: Do we have to install a universal forwarder on the MySQL machine to get MySQL general and error logs? or just only install add-on on the indexer and enable DB Connect inputs? Thanks ... View more

Hi 🙂 we have McAfee Solidifier (software for real-time change monitoring to software code and servers configuration ) . Solidifier is installed on users PC's ,but unfortunately users with administrative privileges can stop Solidifier services and hence stop monitoring !! Using Splunk , we are monitoring McAfee Solidifier service status if it's running or stopped but when user's PC is going to halt ( shutdown) , windows system will generate a message that McAfee Solidifier service has stopped then another message that system will shutdown . like this : Message=The McAfee Solidifier service entered the stopped state. Then : Message=The operating system is shutting down at system time ‎2016‎-‎03‎-‎30T13:15:00.728125000Z. i need to get alert only when Solidifier service is stopped but no shutdown event is generated after it (as in normal shutdown process ) i used this query but it's not working as expected : index="*" EventType=4 | transaction ComputerName startswith="The McAfee Solidifier service entered the stopped state" endswith=search(body!="The operating system is shutting"* ) maxpause=60s kindly find log events sample below : 04:14:56 PM LogName=System SourceName=Microsoft-Windows-Service Control Manager EventCode=7036 EventType=4 Type=Information ComputerName=QC2 TaskCategory=The operation completed successfully. OpCode=The operation completed successfully. RecordNumber=408853 Keywords=Classic Message=The McAfee Solidifier service entered the stopped state. 04:15:00 PM LogName=System SourceName=Microsoft-Windows-Kernel-General EventCode=13 EventType=4 Type=Information ComputerName=QC2 TaskCategory=None OpCode=Info RecordNumber=408854 Keywords=None Message=The operating system is shutting down at system time ‎2016‎-‎03‎-‎30T13:15:00.728125000Z Thanks . ... View more