During update addons in Splunk Enterprise I have following issue: "An error occurred while installing the app: 500" I am not wanting to update addons from file manually. I need to decide cause of this issue. Please help to look for cause? Thanks! ... View more

Hello, We have overflow /opt/splunk/var/spool/splunk directory. It contains stash.new files from 2014 year to today. Splunk doesn't clean their itself. We used script fill_summary_index.py for clean stash.new files but it didn't take desired result. Files in this directory don't clean. I don't can find appropriate method for cleaning these files. Can we to remove manually these files from folder? Please help! ... View more

I have downloaded Splunk Enterprise fron 6.3.3 to 6.4.0, but after installing RPM file to my Server I have seen in WEB interface splunk HUNK. When or who can I download Splunk Enterprise? ... View more

After upgrading Splunk Enterprise from 6.3.3 to 6.4.0, I see this message: [root@splunk bin]# $SPLUNK_HOME/bin/splunk start --accept-license --answer-yes This appears to be an upgrade of Splunk. --------------------------------------------------------------------------------) Splunk has detected an older version of Splunk installed on this machine. To finish upgrading to the new version, Splunk's installer will automatically update and alter your current configuration files. Deprecated configuration files will be renamed with a .deprecated extension. You can choose to preview the changes that will be made to your configuration files before proceeding with the migration and upgrade: If you want to migrate and upgrade without previewing the changes that will be made to your existing configuration files, choose 'y'. If you want to see what changes will be made before you proceed with the upgrade, choose 'n'. Perform migration and upgrade without previewing configuration changes? [y/n] y -- Migration information is being logged to '/opt/splunk/var/log/splunk/migration.log.2016-04-07.10-40-46' -- Migrating to: VERSION=6.4.0 BUILD=f2c836328108 PRODUCT=splunk PLATFORM=Linux-x86_64 Can't create directory "": No such file or directory An error occurred: Could not create audit keys (returned 4). [root@splunk bin]# As a result Splunk does not start. Please help me to resolve this issue! Maybe you have ideas which directions to look. Thank You! ... View more

My app Splunk DB connect 2 does not load and or display on WEB. Plugin is configured default. Javahome (inputs.conf) and java_home (settings.conf) is true. Dbx2 and rpc logs is without Errors. Some Errors are in web_service.log OS - Oracle EL 6.7 Splunk is running from user root privileges and SElinux is disabled. Please help me to resolve this issue! Thank you! Logs from my Server (Were generated when opening the page 😞 [root@splunk splunk]# tail -f web_access.log web_service.log dbx2.log rpc.log ==> web_access.log <== 127.0.0.1 - infosecadmin [05/Jan/2016:17:21:39.601 +0200] "GET /en-US/app/search/license?hideEdit=true&hideTitle=true&hideSplunkBar=true&hideAppBar=true&hideFooter=true&targetTop=true HTTP/1.1" 200 3513 "https://xxx.xxx.xxx.xx:8000/en-US/app/launcher/home" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0" - 568bdf839a7f16c06f3790 1883ms 127.0.0.1 - infosecadmin [05/Jan/2016:17:21:41.533 +0200] "GET /en-US/config?autoload=1 HTTP/1.1" 304 - "https://xxx.xxx.xxx.xx:8000/en-US/app/search/license?hideEdit=true&hideTitle=true&hideSplunkBar=true&hideAppBar=true&hideFooter=true&targetTop=true" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0" - 568bdf85887f16c06f3ad0 9ms ==> web_service.log <== 2016-01-05 17:21:52,346 INFO [568bdf90527f16c05d7d50] cached:77 - memoized decorator used on function <function getEntities at 0x7f16dc6ac848> with non hashable arguments ==> web_access.log <== 127.0.0.1 - infosecadmin [05/Jan/2016:17:21:52.321 +0200] "GET /en-US/app/splunk_app_db_connect/ HTTP/1.1" 303 128 "https://xxx.xxx.xxx.xx:8000/en-US/app/launcher/home" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0" - 568bdf90527f16c05d7d50 408ms ==> web_service.log <== 2016-01-05 17:21:52,758 INFO [568bdf90be7f16c06a6450] cached:77 - memoized decorator used on function <function getEntities at 0x7f16dc6ac848> with non hashable arguments 2016-01-05 17:21:52,976 INFO [568bdf90be7f16c06a6450] view:1034 - bypass module system fast path 2016-01-05 17:21:55,076 INFO [568bdf90be7f16c06a6450] view:1098 - PERF - viewType=fastpath viewTime=1.9873s templateTime=0.331s ==> web_access.log <== 127.0.0.1 - infosecadmin [05/Jan/2016:17:21:52.744 +0200] "GET /en-US/app/splunk_app_db_connect/explorer HTTP/1.1" 200 1559 "https://xxx.xxx.xxx.xx:8000/en-US/app/launcher/home" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0" - 568bdf90be7f16c06a6450 2344ms 127.0.0.1 - infosecadmin [05/Jan/2016:17:21:55.153 +0200] "GET /en-US/config?autoload=1 HTTP/1.1" 304 - "https://xxx.xxx.xxx.xx:8000/en-US/app/splunk_app_db_connect/explorer" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0" - 568bdf93277f16c07833d0 7ms ==> web_service.log <== 2016-01-05 17:21:56,196 INFO [568bdf94227f16c0783e10] error:129 - Masking the original 404 message: 'The path '/en-US/static/@f3e41e4b37b2/js/views/shared/documentcontrols/dialogs/permissions_dialog/ACL.js' was not found.' with 'Page not found!' for security reasons ==> web_access.log <== 127.0.0.1 - - [05/Jan/2016:17:21:56.134 +0200] "GET /en-US/static/@f3e41e4b37b2/js/views/shared/documentcontrols/dialogs/permissions_dialog/ACL.js HTTP/1.1" 404 3115 "https://xxx.xxx.xxx.xx:8000/en-US/app/splunk_app_db_connect/explorer" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0" - 568bdf94227f16c0783e10 63ms ==> web_service.log <== 2016-01-05 17:21:57,057 ERROR [568bdf950c7f16c017a450] utility:49 - name=javascript, class=Splunk.Error, lineNumber=166, message=Error: Script error for: views/shared/documentcontrols/dialogs/permissions_dialog/ACL http://requirejs.org/docs/errors.html#scripterror, fileName=https://xxx.xxx.xxx.xx:8000/en-US/static/@f3e41e4b37b2/js/contrib/require.js ==> web_access.log <== 127.0.0.1 - infosecadmin [05/Jan/2016:17:21:57.049 +0200] "POST /en-US/util/log/js HTTP/1.1" 200 279 "https://xxx.xxx.xxx.xx:8000/en-US/app/splunk_app_db_connect/explorer" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0" - 568bdf950c7f16c017a450 9ms ... View more