I am not currently using summary indexing, or report acceleration, I will look into them though. My search is normally run using the java api.
... View more
I don't know if anyone is still reading this, but if you're doing a join it has a separate subsearch maxtime variable that might need to be changed too.
... View more
mainly for my application 20 second intervals are not needed, and with the current data store that splunk is installed it takes hours to run a search for a whole month. I am currently using it for getting usage data.
... View more
I'm not sure it's fixed or not(whether it will be able to collect data or not) but i was able to make it add the privIds and tell me some roles had rights by removing Host.Config.Power from the list of privileges in logincreator.pl ,(after some checking the host didn't have that permission) it may be that I should have added it to the host instead?
posting as a comment sense I'm not sure it's a complete answer.
... View more
I experienced a problem when setting up my service accounts using:
logincreator.pl --target 10.*.*.* --ad aroot --adpwd apassword --newuser splunkuser --newpwd anotherpassword
I get
ERROR: : A specified parameter was not correct.
privIds
when I type
logincreator.pl --target 10.*.*.* --ad root --adpwd apassword --verbose
I get
Checking 10.*.*.*'s for usernames with correct permissions
Checking 10.*.*.*...
these are the right roleIDs:
...NO ADEQUATE ROLES
and after setting up the enginefile(knowing that the service account i made most likely doesn't work)
in the splunk app install_health page i get
'stats' command: limit for values of field 'name' reached. Some values may have been truncated or ignored.
at the top and am not filling the SA_Performance Addon lookups
I'm using the splunk app for VMware 2.0 but my host and vcenter are 4.1
... View more