Hi, I am trying to deploy a new index to my indexer cluster via the Cluster Master and have followed the usual documentation on how to deploy via the Master-Apps Folder. I have done this before and it has worked no problem but this time I have no idea why it is not working.  When I make the change to indexes.conf and run the command "splunk validate cluster-bundle" it gives me no errors and then brings me back to my CLI so I would presume it has validated it. Then I run the command "splunk show cluster-bundle-status" to check the bundle ID's they are still the same ID's on the active bundle and the latest bundle. Its as if Splunk is not recognising that a change has been made to the bundle and therefore cannot deploy it down to the indexers.   I ran the command "splunk apply cluster-bundle" and it gave me the below error. However when I checked the Splunkd.log on the CM and the Indexers there was no indication of a validation error, or any error for that case. Is there anything that I am missing here? Just cant work out why it is not recognising a change has been made to update the Bundle IDs to be pushed down.  Thanks   ... View more

I am having trouble with one my monitor stanza's. I am trying to monitor a log file for AV threats. I am using 2 stanza's one to monitor the threats and one to change the files to a quarantined file, the quarantined stanza works straight away as soon as a AV breach is found however there is a few hours delay in the monitor threat coming through. I am using the below inputs, "Monitor Stanza to capture events written to VA log" [monitor://C:\Program Files (x86)\Trend Micro\OfficeScan Client\Misc\pccnt35.log] disabled = 0 pollPeriod = 120 source = localhost_av sourcetype = av_threat index=av "AV Quarantine Directory for any new files that have been dropped in by the AV Client" [fschange:C:\Program Files (x86)\Trend Micro\OfficeScan Client\SUSPECT] disabled = 0 pollPeriod = 30 source = localhost_av sourcetype = av_quarantine index=av The threat is writing to the log file in the AV application straight away but it seems to take a few hours sometimes even days for visibility in Splun ... View more