Has any one come across the following error and if any fix worked without reinstalling the forwarder..? The SplunkForwarder service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs. ... View more

As per the documents, i have successfully configured deployer and then further initialized all the Search Members too. Now, while Bringing up Captain continuously failed .. Not sure why we have to define captain if the Election is Dynamic. Anyways, here is the error what i am getting after executing following command, ./splunk show shcluster-status -auth admin username:password > This node is not the captain of the > search head pool, and we could not > determine the current captain. The > pool is either in the process of > electing a new captain, or this member > hasn't joined the pool. after a while i checked and still captain wasn't elected. I also ran bootstrap command to bring up captain and it failed. with error, > In handler > 'shclustermemberconsensus': Failed to > bootstrap this node as a captain. and then one of the node where bootstrap produces result, > In handler 'shclustermemberconsensus': > NOT_LEADER CURRENT_STATE = FOLLOWER ... View more

I am calling vbs script as scripted input in inputs.conf, after which I can see data for most of the servers, but for some servers data seems to be only showing first two lines of the content, and hence eliminating the whole set of approx. 90-100 lines. After manually checking script output on one of the boxes, data seems to be appropriate which means the script is working fine and splunk is failing to consume all the content.. For Eg, Client,5.1.b.20100114R (Registered Version),N/A; Testtools,2.0.1,N/A; Microsoft Visual C++ 2005 Redistributable (x64),N/A,09-05-2013; Microsoft Network Monitor 3.4,3.4.2350.0,09-05-2013; Microsoft .NET Framework 4.5.1,4.5.50938,09-05-2013; Microsoft Network Monitor: NetworkMonitor Parsers 3.4,3.4.2350.0,09-05-2013; for some servers its showing only, Time Client,5.1.b.20100114R (Registered Version),N/A; Microsoft Network Monitor 3.4,3.4.2350.0,09-05-2013; and nothing much. After checking splunkd.log and metrics.log, i don't see any errors for it. ... View more

Here is the sample data AppPoolName : TestApp PrivateMemory : 2000 State : Started Application : IdentityType : NetworkService RecyclingTime : 00:00:00 AppPoolName : .NET v4.0 PrivateMemory : 2000 State : Started Application : IdentityType : ApplicationPoolIdentity RecyclingTime : 01:00:00 AppPoolName : .NET v4.0 Classic PrivateMemory : 2000 State : Started Application : /DefaultApp1 /DefaultApp2 /DefaultApp3 IdentityType : ApplicationPoolIdentity RecyclingTime : 01:00:00 What i am trying to achieve is, every name on left side of colon to be as a field name and values on right side as a field value. Therefore my approach is Spliting the whole event at RecycleTime so we get multiple events and then further extracting fields using Search-Time extraction I tried various events like MUST_BREAK_AFTER, ... _BEFORE ..etc but its not splitting in to multiple event. here is my code Props.conf, [sourcetype] MAX_TIMESTAMP_LOOKAHEAD = 150 MUST_BREAK_AFTER = RecyclingTime NO_BINARY_CHECK = 1 REPORT-1app_field = AppPoolName REPORT-2app_field = Application REPORT-3app_field = IdentityType REPORT-4app_field = PrivateMemory REPORT-5app_field = RecyclingTime REPORT-6app_field = State transforms.conf [AppPoolName] REGEX = (?i).? : (?P\w+) [Application] REGEX = (?ism)Application : (?P.+)(?=IdentityType) [IdentityType] REGEX = (?i)IdentityType : (?P.+)(?=RecyclingTime) [PrivateMemory] REGEX = (?i).? : (?P\d+) [RecyclingTime] REGEX = (?i).? : (?P\d+:\d+:\d+) [State] REGEX = (?i).? : (?P\w+) can you guys suggest, what am i missing in above code to extract events and there fields. ... View more