We had this same issue (message="Access token will expire soon.") and getting the same flat-line because no data was coming in... It was resolved when we replaced the certificate on our HF and in o365 (you need a o365 admin for that part). We burned up way too much time trying to find the root cause ...Right or wrong answer, a new cert fixed the problem. ... View more

In the results of the REST, "create_time" is the time the violation occurred? ... View more

sudosplunk's answer is the solution that worked for me using your example string: (Oct 18 23:38:53 j01ftc Oct 19 12:38:46 akl-ftc-sbc3b.ipsn akl-ftc-sbc3b sipd01[4b] ERROR could not identify psipcontact) [sourcetype] TIME_PREFIX = j01ftc\s TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 15 ... View more

When I am looking for time skews I use the following (credit to Hunter for the SPL) index= earliest=-1m latest=+24h | stats latest(_time) AS time by host | eval now=now() | eval offset=time-now | eval time1=strftime(time,"%F - %T") | eval now1=strftime(now,"%F - %T %Z") | eval offset1=tostring(offset,"duration") | convert ctime(time), ctime(now) | table host offset offset1 time now now1 time1 ... View more

Appendix B: Eventgen troubleshooting tips: http://dev.splunk.com/view/dev-guide/SP-CAAAE3E ... View more

Here are 2 resources to help you: I use this one, it is straight forward and works with any TA that has eventgen files: https://github.com/coccyx/eventgen Recent find I am investigating: https://github.com/splunk/eventgen ... View more

agreed! TMI here! Open a support case with Splunk. ... View more

I will answer all the questions you have...feel free to ask...arion.holliman@gmail.com ... View more

There are thousands of free online courses you can take to educate yourself before tackling a framework like Splunk. ... View more

just starting to get into the deeper sides of computers..... Can you elaborate on your level of experience? ... View more

We need better badges in Answers....there are some really good "answers" here that I don't have the option to give proper credit too. ... View more

Have to say Raj Pal ROCKS! So does Masa and John Welch in no given order!!!!! Arion Holliman - AIG Lead SIEM Engineer ... View more

haha...my response is a year and a half late but yeah....the fact you got a response..... This is a don't ask don't tell community....I cannot confirm nor deny said Corporation has ever existed or every used said product. ... View more

It's not fixed in 4.7.1... Thanks, Arion ... View more

We are using version 6.5.2, I discovered something similar. Our searchheads were showing an error: Failed to add peer 'guid=B193F763-99BC-41B5-89D0-CDEF1F1BF36E server name=splunkindexer14 ip=192.168.12.24:8089' to the master. Error=bucket already added as clustered, peer attempted to add again as standalone. guid=B193F763-99BC-41B5-89D0-CDEF1F1BF36E bid= myindex~38~B193F763-99BC-41B5-89D0-CDEF1F1BF36E ) To fix this I needed to find the bucket: Log into the indexer, become splunk, get in the path of the offending bucket and find it. $> su - splunk $> cd /x/x1/db/<index> $> ls -lh 2) The problem bucket will stand out like a sore thumb and be easy to spot because its name will be shorter than all the others. Actual standalone bucket that caused the problem:  db_1487878740_1487878740_38 3) Rename it using move as shown below, adding the CM GUID: (leaving out the double quotes) $> mv “db_1487878740_1487878740_38” “db_1487878740_1487878740_38_B193F763-99BC-41B5-89D0-CDEF1F1BF36E” 4) Now do list again ( “ls | grep ” ) and verify you were successful, you should see the renamed bucket: $> ls | grep db_1487878740_1487878740_38 db_1487878740_1487878740_38_B193F763-99BC-41B5-89D0-CDEF1F1BF36E 5) Reboot the indexer Many thanks Rajpal! ... View more

do not update unless your checkpoint environment meets the requirements of the most recent release. ... View more