What was your findings on pushing this out to a universal forwarder?  I am looking at the same thing since we see this error from 3k+ forwarders. 🙂 ... View more

We are having a similar issue but with permissions.  Opened a support ticket initially and it looked like a role was missing but after adding the role the error is still persistent.  We also added the capabilities that were missing with that role but that didn't fix it either.   ### Missing Windows Capabilities [capability::edit_modinput_winhostmon] [capability::edit_modinput_winnetmon] [capability::edit_modinput_winprintmon] [capability::edit_modinput_perfmon] [capability::edit_modinput_admon]   [role_window-admin] edit_modinput_winhostmon = enabled edit_modinput_winnetmon = enabled edit_modinput_winprintmon = enabled edit_modinput_perfmon = enabled edit_modinput_admon = enabled     ... View more

Having the same issue after upgrading from 4.4.5 to 4.7.0.  We just tried going from our broken 4.7.0 to 4.9.0 in hopes that we would get our service analyzer back, instead, we are now getting a license error and ITSI is non-functional.  Not sure what happened after 4.4.5 and Splunk 8.1.5 but we are now down and non-operational.  ... View more

How can this app be deployed to an existing enterprise environment with over 2k forwarders? The script fails when it see's an existing forwarder installed on the host. I also get a failure when the host tries to reach out to the world, firewall rules in enterprise environments typically block external routing. I was not able to locate any documentation around pre-existing environments and deploying this app. ... View more

Hello Guilhem, Thanks for the quick reply, below is the answers to your questions. I am working on some of your suggestions now. Is this is happening on multiple boxes ? yes, about 116 boxes out of 170 Which Linux distribution and version ? SUSE Linux Enterprise Server 11 (x86_64) kernal version = 3.0 Is this happening continuously or sporadically ? We just started testing this app on the 3rd of July, its been up and down since then. 557k events since the 3rd over 100 plus boxes. Splunk version. 7.0.2 forwarders are 6.4.4 ... View more

Glad to hear! We love the app and have been fine tuning things on the back end. I am sure you follow all the threads on here, but we did have that DM issue on clustered environments but found the resolution here. My users love the app but have been requesting historical trends over 3 months or more. Currently our DM is setup for 7 days so the dashboard panels will not search past those seven days. We also had a request to build a visit tracker by cs_name instead of the md5 name, could be something to add in the future. Our biggest fight has been the unknown browser agents, but I saw your post today and will use that. Thanks for a great app, we are all anticipating a fresh update! 🙂 ... View more

Yes, make sure the following fields are enabled in your IIS logging: cs_Referer cs_version cs_bytes cs_Cookie We pretty much enabled all the IIS logging and the app looks pretty good. Make sure to read up on the threads in here, we had to make a change to the Data Model in order for the app to work in a search head cluster. Also, read the latest update on http_user_agent. https://answers.splunk.com/answers/442049/splunk-app-for-web-analytics-http-user-agent-missi.html#comment-641842 ... View more

Thanks for the reply! After pushing the new cert I restarted the forwarder and everything connected fine. The log file is only 48MB in size. We validated the crc and it looks like the forwarder tracked everything from file creation . Its been a few hours now but splunk still only shows data from 10am onward. I was going to do a one-shot but I don't want to duplicate the events from 10 am 🙂 I was thinking maybe the forwarder buffer ran over but at 30MB it should have retained the data without any issues. Its like the forwarder thinks it sent the data to the indexers. -odd (6.5.2 fwd /v 7.0.1 on indexers) ... View more

When we add a new site we do re-run the look-up's, this is how the data gets published in the DM. You are probably aware the rebuild on the DM takes a bit of time. We are still in test phase, so we do rebuild the DM with any changes we apply. Yes to your first question, it will see the new logs as they rotate into the directory. ... View more

Same for me as well, we are trying to update the web-analytics app due to the large amount of "unknown" browsers being returned in the app dashboards. Has anyone figured out how to successfully update ua_parser in Splunk? ... View more

Drilldown Example Table Complex <input type="text" token="component" searchWhenChanged="true"> <label>component</label> <default>*</default> </input> <input type="text" token="log_level" searchWhenChanged="false"> <label>log_level</label> <default>*</default> </input> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <panel> <table> <search> <query>index=_internal sourcetype=splunkd| stats count(eval(log_level="INFO")) as INFO count(eval(log_level="ERROR")) as ERROR by component</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> <drilldown> <condition field="component"> <set token="component">$click.value$</set> <set token="log_level">*</set> </condition> <condition field="INFO"> <set token="log_level">$click.name2$</set> <set token="component">$click.value$</set> </condition> <condition field="ERROR"> <set token="log_level">$click.name2$</set> <set token="component">$click.value$</set> </condition> </drilldown> </table> </panel> <panel> <event> <title>$component$ $log_level$</title> <search> <query>index="_internal" sourcetype=splunkd component="$component$" log_level="$log_level$"</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="list.drilldown">none</option> <option name="raw.drilldown">none</option> <option name="table.drilldown">none</option> <option name="type">list</option> </event> </panel> ... View more