is it compatible with splunk 6.4??

[tp92222]

is it compatible with splunk 6.4?? if not any plans to update ???

[LukeMurphey]

I haven't tested it yet, but I would be very surprised if it failed to work. I'll do some testing tomorrow and post a comment here.

Update:

I tested it and it works fine. Let me know if you see any issues.

[tp92222]

after adding rss feed ..i still see number of input as 0

Data inputs » TCP page

I am using 6.4.0

[LukeMurphey]

Can you try a couple of debugging steps? First, see if any errors or relevant messages are returned with this search:

(index=main sourcetype=syndication)  OR (index=_internal sourcetype="syndication_modular_input")

Second, see if the following tells you why entries are being skipped:

index=_internal sourcetype="syndication_modular_input" | rex field=_raw "(?<action>((Skipping)|(Including)))" | search count>0 OR action=Including  | table date latest_date title action count

[tp92222]

Yes i am able to see some logs

but once i configure rss input it doent get displayed in Data inputs menu

please refer below screen shot

https://app.box.com/s/1sp9sp0b7hi1quxjh9aw37qora6g2hbr

i am not able to make changes to those inputs or delete rss input feeds

[LukeMurphey]

Ah, I see now. The input isn't even showing up. Check the logs in the _internal index for anything that indicates that the modular input could not be run. Also, check the messages list (in the top-right of the screen) to see if it says something about the modular input failing to initialize.

[tp92222]

i am getting following logs

https://app.box.com/s/58kz5lifwiegnz0wopxxindwy8gnx0if

also there is no msg like "modular input failing to initialize."

[LukeMurphey]

Is this a public RSS feed? I'm struggling to reproduce this and I' m wondering if it I could reproduce it with the feed you are using it with. Let me know if you can share the feed URL with me.