How to display the error input or value errors in a pop up? I am trying to build a custom command and want to show errors raised or returned in a pop up or modal. For example: In the inputlookup , if no csv name is provided, it will return below error. How to show it in form of an pop up or modal? Also how to remove the First line and display only the 2nd and 3rd line? @splunk  @niketnilay  

We removed a number of files to prevent problems with log4j. Now when I run a file integrity check, the missing files are showing up as "missing". Since we know we removed them, I would like to have the file integrity check skip those files. How do I do this?

I'm using my on-prem DS to push out apps to my UFs. The current cert has expired, how can I push a new cert to my UFs? I see that in my DS, I have a directory /opt/splunk/etc/deployment-apps/100_splunkcloud/default/. In this directory I have a server.pem file with last year's date. Is this where I need to move the new pem file? I thought it was in the /opt/splunk/etc/deployment-apps/100_splunkcloud/local directory instead.    Thank you!

Hi there, So I've first download  the machine learning toolkit app but  was not able to run the app due to this error: " Python for Scientific Computing is a Splunk Add-on that includes several Python libraries for scientific computing, including numpy, scipy, pandas, scikit-learn, and statsmodels. Several of the dashboards included in the Machine Learning Toolkit require these modules. Please download and install the platform-specific version of this add-on that is appropriate for your Splunk Search Head:" So I've download the correct add on Python for Scientific Computing  but neither of the apps are working. 

Below is the sample log: {[-]     context: default      level: INFO      logger: logginfdata.pre-request.util     mdc: { [+]  } message:  this is a json request [evenId=76546787678888899999]] thread: RealtimeExecutor-1999 timestamp: 2022-03-23 15:44:41.965 } may i know how can write props for this kind of logs.

I recently re-installed MS Windows AD Objects app due to some issues. After the re-install, I tried the lookups build configuration wizard, but it doesn't seem to build lookups even though wizard ran successfully with all green "successful" message.  I tried reseting the admon baseline, adding manual domain input but still no luck. Indexes look correct, log is still getting ingested,  I used pre-defined TA inputs.conf files, mainly working with 1 DC. This DC has below apps. Splunk_TA_windows  Splunk_TA_windows_dc Splunk_TA_windows_admon  Main lookup i'm trying to build is 'AD_User_LDAP_list' as my searches with this lookup shows error message "The lookup table 'AD_User_LDAP_list' requires a .csv or KV store lookup definition." Can somebody point me to the right direction to fix this issue?  

Hello, I currently have the DB Connect plugin installed to receive the logs from an aurora database. To date everything works without problem but my client tells me that he needs to go from version 11.6 to version 11.5 I would like to know if I should do something or the fact that it is already working with the current version implies that with a higher version it should not affect anything?   https://docs.splunk.com/Documentation/DBX/3.8.0/JDBCPostgres/About  

Hello,   I am performing Splunk UF installation of version 8.0.5 and getting following error logged in error logs: ==> splunkd.log <== 08-23-2022 10:00:29.018 -0400 WARN TcpOutputProc - Pipeline data does not have indexKey. [_conf] = |||\n 08-23-2022 10:00:29.018 -0400 WARN TcpOutputProc - The event is missing source information. Event : no raw data I am not sure what is this error means. I can see that sources defined in config files are sending logs to Splunk. Could someone suggest how I can fix these errors to make sure no data lose there?

Hi Team, I'm trying to create getting response time from the below logs by using Trace ID( Or any unique value) as my logs don't have any specific URL. http-nio-8080-exec-8,WARN,com.xxx.product.stoc.jpa.graph.AgreementProcessorServiceImpl, CHANNEL_ID : UI, RUN_ID : F3E51C72B62AC15C4E3FF2458A30C88F, TRACE_ID : 7uITsJ7CQ7MbWZZQZ9Ntz3, COLLATE_USER_ID : mashetta, EXTERNAL_USER_ID : _]  dt.trace_sampled: true, dt.trace_id: ed71da8c7bedadc2c9c568c04d91eafe, dt.span_id: feb179cfd106945fFacility 5766 has no Exposures, which are needed for a LGD calculation scheduling-1,INFO,com.xxxeventbus.sdk.listenerimpl.service.RetryCron, CHANNEL_ID : , RUN_ID : , TRACE_ID : , COLLATE_USER_ID : , EXTERNAL_USER_ID : ] Deleted 6 Completed or Failed received events. elastic-595,WARN,com.xxx.product.stoc.jpa.graph.AgreementProcessorServiceImpl, CHANNEL_ID : , RUN_ID : , TRACE_ID : , COLLATE_USER_ID : , EXTERNAL_USER_ID : ] All the Exposures have no Start Date and all the LED/Exposure links have no Rank EntityChangeExecutor_39,WARN,org.elasticsearch.client.RestClient, CHANNEL_ID : , RUN_ID : , TRACE_ID : , COLLATE_USER_ID : , EXTERNAL_USER_ID : ]  dt.trace_sampled: true, dt.trace_id: 73a4a5de4e28679b9c9330c852d9cc59, dt.span_id: 229f2f590836fc19request [POST http://<myurl:9200/] returned 2 warnings: [299 Elasticsearch-7.17.2-de7261de50d90919ae53b0eff9413fd7e5307301 "Elasticsearch built-in security features are not enabled. Without authentication, your cluster could be accessible to anyone. See <HTML File> to enable security."],[299 Elasticsearch-7.17.2-de7261de50d90919ae53b0eff9413fd7e5307301 "[ignore_throttled] parameter is deprecated because frozen indices have been deprecated. Consider cold or frozen tiers in place of frozen indices."] elastic-602,INFO,com.xxx.product.stoc.jpa.service.eligibility.EligibilityServiceImpl, CHANNEL_ID : , RUN_ID : , TRACE_ID : , COLLATE_USER_ID : , EXTERNAL_USER_ID : ] Calculated eligibility of LED 6209 as 0 with result id 1885. elastic-602,INFO,com.xxx.product.stoc.jpa.service.eligibility.EligibilityServiceImpl, CHANNEL_ID : , RUN_ID : , TRACE_ID : , COLLATE_USER_ID : , EXTERNAL_USER_ID : ] Checking eligibility of LED 6209... INFO,com.xxx.product.stoc.jpa.service.eligibility.EligibilityServiceImpl, CHANNEL_ID : , RUN_ID : , TRACE_ID : , COLLATE_USER_ID : , EXTERNAL_USER_ID : ] Calculated eligibility of LED 6235 as 0 with result id 1883. Your help is much appreciated

I have a field value like this that I want to exclude.   [22minfo[3: host.console[0]   The searches I can think of either don't do anything or return an error. Note, I am trying to speed up a search so I do not want to use regex.  Searches I tried:     message != [* message != "["* message != "[*" message != '[*' message != '['*    

We have some servers that are deployed in AWS and we want to monitor some files that are on them.  Typically, I'd go with the UF, but in this case our indexers only have private IPs.  We do have some Heavy Forwarders that can be publicly addressed.  We have only used that for HEC though.  The Heavy Forwarders do have receiving set up on port 9997, but wouldn't that inde the data locally on the servers?   Have any of you had a similar issue?   We have a clustered on prem enviroment BTW.

We had the TA-mailclient v1.5.5 installed on our IDM. However when trying to configure the data input - Data inputs -> Mail server - that option was not available. After communicating with Splunk Support it became clear that the option on the Splunk Cloud IDM is not available (not visible) for the role sc_admin. Any ideas / suggestions on how to solve this issue or is it a known bug or is it by design and is the TA not intended to run on the IDM