I used the REST method, and found that it worked even in a clustered environment (Search Heads and indexers). Command used on a search head: curl -k -u admin:<password> https://localhost:8089/servicesNS/<old  owner>/ING-SA-Search/data/props/extractions/<object>/acl -d 'owner=<new owner>' -d 'sharing=app' Where object is the urlencoded version of the full field extraction name, e.g. my:srctype : EXTRACT-SomethingInteresting Becomes my:srctype%20:%20EXTRACT-SomethingInteresting I found that this change was then replicated to the other search heads appropriately ... View more

I've encountered this issue as well - any update on how to resolve it? ... View more

Try this: | rex field=_raw "^(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?,(?[^,]+)?" ... View more

This should now be fixed in v6.6.6. Initial testing with this version indicates that PowerShell scripts are being run on schedule again. ... View more

I've found that from Splunk v6.6+, PowerShell script scheduling is broken (i.e. it runs extremely sporadically, if at all) - there appears to be an issue with sending signals from $SPLUNK_HOME/bin/splunk-powershell.exe to $SPLUNK_HOME/bin/splunk-powershell-common.ps1 - specifically the WaitForWinMultipleObjects statement in the waitCronEvents function just isn't getting anything meaningful to respond to. I've raised the issue with Splunk and am awaiting a resolution. Short term work-arounds - I've found two (both work for Splunk v6.6, not tested under 7.0.x) Replace splunk-powershell.exe with a version from an earlier version of Splunk (any of the 6.5.x series appear to be find) Deploy the Splunk Add-on for Microsoft PowerShell (SA-ModularInput-PowerShell). I renamed SA-ModularInput-Powershell\windows_x86_64\Powershell.exe to PowershellM.exe (ditto for the associated config file), and updated the README\inputs.cof.spec (to powershellm://default]), in order to avoid namespace conflicts. Reminder - the Add On uses a different scheduler, you'll need to update your schedule to match. ... View more

I received this error post upgrading from 6.5.2 to 6.3.3. For me, it occurred on a Search Head Cluster - which included deployment of the original search app (e.g. /opt/splunk/etc/shcluster/apps/search) from the deployer - obviously the the upgrade didn't upgrade this instance of the search app, and a later deployment then overwrote the 6.3.3 search app on the cluster with a 6.5.2 one which then started spitting out the createSSLContextFromSettings error. Initial Resolution: updated /opt/splunk/etc/shcluster/apps/search from (a post 6.3.3 upgrade of) /opt/splunk/etc/apps/search and redeployed. Long term resolution: migrate all deployed 'local' Knowledge Objects to a new app and strongly discourage users from creating new objects in the search app on the SHC. ... View more

Coming late to the party, and in response to the query in regards to the Microsoft Active Directory integrated Certificate Authority (and possibly other CA's) - you need to ensure that the resulting certificate is allowed to be used for Server authentication. First - all the points made by kermitshort are correct - so start there, however... Having only seen one instance of MS AD Cert Services (well two, one test and one prod, but both setup in a similar way), I can only assume some things are common - mainly that when you submit your csr, you're asked which Certificate Template to use. These appear to be site specific, but you'll need one that returns a cert with the rights to be used for Server Authentication - at least on the receiving (inputs) side of the communication (e.g. the indexers) The only way I've found out how to confirm this is once I've received the new certificate, I run it through openssl: splunk cmd openssl x509 -in <newcert> -text -noout and check the output for the Extended Key Usage for the Server Authentication usage: X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication Discuss the template capabilities with the owner of your Microsoft PKI setup... Note: without this, I was getting the following errors... [From Indexer] 08-17-2017 11:02:10.257 +1000 ERROR TcpInputProc - Error encountered for connection from src=. error:14094413:SSL routines:ssl3_read_bytes:sslv3 alert unsupported certificate [From universal forwarder] 08-17-2017 10:58:10.742 +1000 ERROR TcpOutputFd - Connection to host= failed. sock_error = 0. SSL Error = error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed ... View more

The setup assumes that you have very little data in your Splunk environment - and does a 'open' search against your default indexes for any of the sourcetypes it's looking for - in a large environment, these searches will take longer than the timeout (hence the suggestions to increase the time out in the answers above). If you are in a large environment, I would highly recommend directly editing Splunk_CiscoSecuritySuite/bin/css_setup_handler.py to make the searches a little more restrictive (e.g. add in an index clause to help setup find what its looking for, or simply pull all the searches and set the flags directly (e.g. alter the lines looking like info['asa_count'] = 0 to = 1 instead where a feature should be installed). Also note that the app does not appear to be SHC compliant - so the setup needs to be run on each node. ... View more

Rewrote ./bin/ta_ontap/OntapPerf.py to query system:node instead of system (as held in the objectType parameter), when ontap v8.3+ is detected. Amended OntapClinet.py as well (to manage querying the ontap version). Not a 100% fix, as it appears some of the resulting attributes are different - not a perfect 1:1 match for data structure - but good enough for us. Small print in the hardware and software requirements for the Splunk app do actually note that only up to 8.2 is supported... Splunk App developers have been contacted with details of my workaround. ... View more

Investigation has shown that 8.3 returns different information to 8.2 - case opened with Splunk and NetApp to resolve. Basic issue - for a cluster, when asked for system objects. 8.2 returned an object per node. 8.3 returns a one cluster object. ... View more

Also observed on v8.3.2P6 ... View more

Because of the App Management Issues section as per Create deployment apps http://docs.splunk.com/Documentation/Splunk/6.4.1/Updating/Createdeploymentapps Basically - the splunk_httpinput app is installed with the splunk itself - and if it ends up containing version dependent code, then my environment is sunk (as serverclass.conf doesn't filter on splunk version at this time). And given adding the app to DS is irreversible, the 'damage' can't be undone. ... View more

Linux Heavy Forwarder (v6.3.4 and v6.4.1) is also showing this issue. Commenting out the entire stanza in splunk_httpinput appears to resolve the issue. (Luckily I don't use splunk_httpinput at this time, so that's a viable option - along with probably moving the file to an alternate name (not tested). Not sure how to update a fleet of over 1000 servers cleanly and neatly with this change - don't really want to put a default app in Deployment Server (which would appear to be the easiest answer) - I've been warned that this is not best practice... ... View more

Can you supply the structure (i.e. the headers) of those csv files (or close facsimile) and what sort of comparison you actually want to make. ... View more