I can't get the app to work at all. We have a syslog server that forwards logs to our indexer. I have the Clearpass app installed on our Search Head. I've followed the instructions in the PDF, but I can't get my dashboards to populate. The logs are going to the index, the source type is correct, I see the event types beginning with cppm, and I've enable to the system to check the index by default. I keep seeing this cphost argument, but it's not in the logs. I don't know what else I can do at this point. ... View more

Hello All, I'm receiving the following error when I try to create a diag file; ./splunk diag Collecting components: app:splunk_app_db_connect, conf_replication_summary, consensus, dispatch, etc, file_validate, index_files, index_listing, kvstore, log, pool, searchpeers Skipping components: rest Selected diag name of: diag-pel501.mascocs.com-2017-09-19_12-51-02 Starting splunk diag... Logged search filtering is enabled. Skipping REST endpoint gathering... Determining diag-launching user... Getting version info... Getting system version info... Getting file integrity info... Getting network interface config info... Getting splunk processes info... Getting netstat output... Getting info about memory, ulimits, cpu (on windows this takes a while)... Getting etc/auth filenames... Getting Sinkhole filenames... Getting search peer bundles listings... Getting conf replication summary listings... Getting KV Store listings... Getting index listings... Copying Splunk configuration files... filtered out file '/opt/splunk/etc/apps/SA-VMW-HierarchyInventory/lookups/TimeVirtualMachinesOnDatastore.csv' limit: 10485760 size: 11582385 filtered out file '/opt/splunk/etc/apps/SA-EndpointProtection/lookups/localprocesses_tracker.csv' limit: 10485760 size: 1261901947 Exception occurred while generating diag, we are deeply sorry. Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 4573, in main create_diag(options, log_buffer) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 4096, in create_diag copy_etc(options) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 1939, in copy_etc add_dir_to_diag(etc_dir, "etc", ignore=etc_filt) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 693, in add_dir_to_diag storage.add_dir(dir_path, diag_path, ignore=ignore) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 488, in add_dir collect_tree(dir_path, diag_path, adder, ignore=ignore) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 3069, in collect_tree collect_tree(srcname, dstname, actor, ignore) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 3069, in collect_tree collect_tree(srcname, dstname, actor, ignore) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 3069, in collect_tree collect_tree(srcname, dstname, actor, ignore) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 3072, in collect_tree actor(srcname, dstname) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 649, in add_file_to_diag add_fake_special_file_to_diag(file_path, diag_path, special_type) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 625, in add_fake_special_file_to_diag storage.add_fake_file(file_path, name) File "/opt/splunk/lib/python2.7/site-packages/splunk/clilib/info_gather.py", line 506, in add_fake_file tinfo.size = 0 AttributeError: 'NoneType' object has no attribute 'size' Diag failure, writing out logged messages to '/tmp/diag-fail-TUZmYc.txt', please send output + this file to either an existing or new case ; http://www.splunk.com/support We will now try to clean out any temporary files... Has anyone seen this error before? ... View more