Error running https://<server>:8000/en-US/debug/refresh I have recently started receiving a 503 error when trying to execute the debug refresh feature. This has worked just fine previously. I receive this error after pressing "Refresh" button on the https://<server>:8000/en-US/debug/refresh page v7.2.7 Enterprise Security server splunkd is running Normal Slunk UI is accessible just fine Unable to correlate error with any message(s) in splunkd.log (not saying there are none - just nothing that I can make sense of with regard to this) ************** 503 Service Unavailable Oops. The splunkd daemon cannot be reached by splunkweb. Check that there are no blocked network ports or that splunkd is still running. Click here to return to Splunk homepage. <Confused equine> ************** ... View more

After installing the app I am unable to configure it. Neither the "Input" or "Configuration" panels will load - they simply clock. The one message i am able to find is: "Unable to initialize modular input "geoipupdate" defined inside the app "SecKit_SA_geolocation": Introspecting scheme=geoipupdate: script running failed (exited with code 1)." Have tried this on an ES and Search Head instance with the same results. ... View more

If I have a single alert search with multiple conditions that looks something like this: index=X condition1 OR condition2 OR (condition3 AND subcondition1) OR condition4 OR condition5 OR (condition6 AND subcondition2) Is there a way to display the actual conditional statement that was met without creating a separate alert for each condition? In other words, does Splunk set some internal variable that holds the triggered condition (for example - "(condition3 AND subcondition1)") that is accessible to display in an email or notable event? ... View more