A custom JavaScript error caused an issue loading your dashboard. I'm experiencing this error on both the palo alto networks app and add-on app; I'm unsure why reporting is no longer ingesting data. Thanks     ... View more

We're unable to get the forwarder to index/re-index and populate data - any make out what is happening here? Thanks 03-06-2018 22:08:21.280 +0000 INFO TailReader - Ignoring file '/tmp/hsperfdata_root/3843' due to: binary 03-06-2018 22:08:39.078 +0000 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh" which: no tshark in (/opt/splunk/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin) 03-06-2018 22:08:39.104 +0000 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh" /opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh: line 8: -v: command not found 03-06-2018 22:08:39.111 +0000 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh" /opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh: line 31: [: : integer expression expected 03-06-2018 22:08:39.153 +0000 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/Splunk_TA_nix/bin/rlog.sh" Redirecting to /bin/systemctl status auditd.service 03-06-2018 22:08:40.347 +0000 WARN FileClassifierManager - The file '/tmp/hsperfdata_root/3843' is invalid. Reason: binary 03-06-2018 22:08:40.347 +0000 INFO TailReader - Ignoring file '/tmp/hsperfdata_root/3843' due to: binary 03-06-2018 22:08:48.320 +0000 WARN LineBreakingProcessor - Truncating line because limit of 1000000 bytes has been exceeded with a line length >= 1003520 - data_source="lsof", data_host="harplg01.stag.defence.gov.au", data_sourcetype="lsof" 03-06-2018 22:09:08.887 +0000 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh" which: no tshark in (/opt/splunk/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin) 03-06-2018 22:09:08.936 +0000 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh" /opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh: line 8: -v: command not found 03-06-2018 22:09:08.947 +0000 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh" /opt/splunk/etc/apps/SplunkForPCAP/bin/pcap2csv.sh: line 31: [: : integer expression expected 03-06-2018 22:09:10.449 +0000 WARN FileClassifierManager - The file '/tmp/hsperfdata_root/3843' is invalid. Reason: binary 03-06-2018 22:09:10.449 +0000 INFO TailReader - Ignoring file '/tmp/hsperfdata_root/3843' due to: binary 03-06-2018 22:09:19.336 +0000 WARN DateParserVerbose - Accepted time format has changed ((?i)(? ... View more

I'm not able to edit this file due to permissions; anyone know if you require a chmod on the file to write the changes? /opt/splunkforwarder/etc/system/default/limits.conf" File is read only ... View more

/opt/splunkforwarder/bin/splunk edit user admin -password $NEWPASSWORD This doesn't work - how can I change the password without knowing the default or entered password for the forwarder? ... View more

Anyone seen this error before? Error in 'lookup' command: The lookup table 'user_realnames_lookup' does not exist or is not available. ... View more

Name Actions App Current Size System Search What is the difference between System and Search under APP within the Indexes ... View more

I'm trying to source what indexes.conf is being utilized for each index; for example, I have an index called Web. What I'd like to configure is the total max size of 275GB for that index using a retirement and archiving policy (maxTotalDataSizeMB). But I don't know what index applies to what Indexes.conf (several are listed). Further, can I set up a different index to use as indexes.conf (not the default)? ... View more

I've run into an issue with one of my indexes (web)! The partition is 300GB and is now full, how can I purge the index to reduce the size by maintaining a consistent DB table for search strings and for the Web proxies app reporting? Thanks ... View more

I've recently cloned a dashboard within APP Web Proxies (Proxy SG). I'm able to view that dashboard by searching for it in the upper left but how can I make this the default APP for Everyone (basic users) as the default dashboard? Can I assign that everyone gets the limited (cloned) dashboard while ADMIN users get the full blown proxy dashboard? Thanks... ... View more