This issue is usually due to latency issue with the network or HF. The workaround is to manually add the inputs by configuring the inputs.conf,  passwords.conf, ta_tenable_account.conf and the ta_tenable_settings.conf files. The password will be hashed after Splunk is restarted. ... View more

Worked like charm!!! Thanks ... View more

This is how I took care of a similar issue: 1. I ran a search on the SH:     index=my_index sourcetype=my_sourcetype | delete 2. After confirming that the records have been delete, I went to the HF - stopped Splunk -  /opt/splunk/bin/splunk cmd btprobe -d /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/ --file /my_file_path/filename.fileextension --reset - restarted Splunk and was able to see new data in SH ... View more

I resolved a similar issue by opening up port 8089 ... View more

It worked!!! Thanks ... View more

Step 5 is Renamed current server.pem to server.pem.old: mv /opt/splunk/etc/auth/server.pem /opt/splunk/etc/auth/server.pem.old ... View more

In our case, the issue was as a result of the expired certs: Error: Error in 'inputlookup' command: External command based lookup 'app_name' is not available because KV Store initialization has failed. Contact your system administrator Here is the fix: splunkd.log: ERROR KVStoreLookup - External command based lookup 'app_name' is not available because KV Store initialization has not completed yet...... mongod.log: The provided SSL certificate is expired or not yet valid.... Check Certs: /opt/splunk/bin/splunk cmd openssl x509 -enddate -noout -in /opt/splunk/etc/auth/server.pem notAfter=Sep 8 17:56:51 2019 GMT Stopped Splunk service Renamed current server.pem: mv /opt/splunk/etc/auth/server.pem /opt/splunk/etc/auth/server.pem Restarted Splunk services Checked Certs: /opt/splunk/bin/splunk cmd openssl x509 -enddate -noout -in /opt/splunk/etc/auth/server.pem notAfter=Oct 24 17:38:28 2022 GMT Results where displayed for app. ... View more

This worked for me. Thanks ... View more

make sure you that your -target is pointing to the right server e.g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089 instead of .g. /opt/splunk/bin/splunk apply shcluster-bundle -target https://1.1..200:8089 ... View more

List the fields e.g | fields Host Percent will prevent count from showing ... View more