I have a panel which shows the usage of a dashboard in GMT timezone. Is it possible to show the same data in different timezones (PST, EST, IST, etc) as different lines in same chart? Below is the query which shows count in GMT timezones  index="_internal" user!="-" sourcetype=splunkd_ui_access "GET" "sample" | rex field=uri "\/app\/(?<App_Value>\w+)\/(?<dashboard>[^?\/]+)" | search App_Value="sample" dashboard = "daily_health" |timechart count  How can we modify this query to show in different timezone in single chart?

If an cloud application like Servicenow or Salesforce is integrated with central authentication like Azure AD for authenticating users, how can I identify user authentication logs for these specific apps from Azure AD logs ? I am looking at logs using this query index=o365 sourcetype=o365:management:activity | stats count by vendor_product but most of these vendor products are microsoft based. I don't see any other cloud apps here. Would somebody be able to help me with this please ?

Hi, When I add all the details required on the Splunk add-on for office 365, I click add and then get the following error: 06-14-2022 20:01:41.224 +0500 ERROR ExecProcessor [432 ExecProcessor] - message from ""C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\em_group_metadata_manager.py"" urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /services/server/info (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x000001A64EF67848>: Failed to establish a new connection: [WinError 10061] No connection could be made because the target machine actively refused it')) And 2022-06-14 20:01:40,884 - pid:18576 tid:MainThread ERROR em_group_metadata_manager:94 - Failed to execute group metadata manager modular input -- Error: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /services/server/info (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x000001A64EF67848>: Failed to establish a new connection: [WinError 10061] No connection could be made because the target machine actively refused it')) Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\connection.py", line 160, in _new_conn (self._dns_host, self.port), self.timeout, **extra_kw File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\util\connection.py", line 84, in create_connection raise err File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\util\connection.py", line 74, in create_connection sock.connect(sa) ConnectionRefusedError: [WinError 10061] No connection could be made because the target machine actively refused it During handling of the above exception, another exception occurred: Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\connectionpool.py", line 677, in urlopen chunked=chunked, File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\connectionpool.py", line 381, in _make_request self._validate_conn(conn) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\connectionpool.py", line 978, in _validate_conn conn.connect() File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\connection.py", line 309, in connect conn = self._new_conn() File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\connection.py", line 172, in _new_conn self, "Failed to establish a new connection: %s" % e urllib3.exceptions.NewConnectionError: <urllib3.connection.HTTPSConnection object at 0x000001A64EF67848>: Failed to establish a new connection: [WinError 10061] No connection could be made because the target machine actively refused it During handling of the above exception, another exception occurred: Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\requests\adapters.py", line 449, in send timeout=timeout File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\connectionpool.py", line 727, in urlopen method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2] File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\urllib3\util\retry.py", line 446, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause)) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /services/server/info (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x000001A64EF67848>: Failed to establish a new connection: [WinError 10061] No connection could be made because the target machine actively refused it')) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\em_group_metadata_manager.py", line 89, in do_execute if not em_common.modular_input_should_run(session['authtoken'], logger=logger): File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\common_libs\logging_utils\instrument.py", line 69, in wrapper retval = f(decorated_self, *args, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\em_common.py", line 342, in modular_input_should_run if not info.is_shc_member(): File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\server_info.py", line 140, in is_shc_member server_info = self._server_info() File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\utils.py", line 159, in wrapper return func(*args, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\server_info.py", line 62, in _server_info return self._rest_client.info File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\splunklib\client.py", line 463, in info response = self.get("/services/server/info") File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\splunklib\binding.py", line 289, in wrapper return request_fun(self, *args, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\splunklib\binding.py", line 71, in new_f val = f(*args, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\splunklib\binding.py", line 679, in get response = self.http.get(path, all_headers, **query) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\splunklib\binding.py", line 1183, in get return self.request(url, { 'method': "GET", 'headers': headers }) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\splunklib\binding.py", line 1241, in request response = self.handler(url, message, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\splunk_rest_client.py", line 145, in request verify=verify, proxies=proxies, cert=cert, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\requests\api.py", line 60, in request return session.request(method=method, url=url, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\requests\sessions.py", line 533, in request resp = self.send(prep, **send_kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\requests\sessions.py", line 646, in send r = adapter.send(request, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_infrastructure\bin\external_lib\solnlib\packages\requests\adapters.py", line 516, in send raise ConnectionError(e, request=request) solnlib.packages.requests.exceptions.ConnectionError: HTTPSConnectionPool(host='127.0.0.1', port=8089): Max retries exceeded with url: /services/server/info (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x000001A64EF67848>: Failed to establish a new connection: [WinError 10061] No connection could be made because the target machine actively refused it'))  

Hello all, We are using an RSyslog to write logs to file in a Heavy Forwarder but we found that it was escaping tabs as #011. We found a solution that is apply to the file source a SEDCMD as follows: inputs.conf   [monitor:///opt/splunk-data/<datafile>] sourcetype=<datasource>    props.conf   [source::///opt/splunk-data/<datafile>] SEDCMD-fix_tab = s/#011/ /g     We applied the configuration and restarted the HF and worked by about 15 minutes but then suddenly stopped to change this character by a tab. Why can this happen? Thank you!

Hi All,   We are trying to enable our splunk to pass logs to a Non Splunk System, we found out that we can configure the outputs.conf and add the below:   [tcpout] [tcpout:fastlane] server = <ip>:<port> sendCookedData = false   My question is, on the receiving end where will be those logs/data be stored? Is anyone have tried this or is anyone have an idea on this. Appreciate your help on this. Thanks!

Hello, I have a prebuilt panel that looks like this     <panel> <chart> <title>$titlePanel$</title> <search> ...     I'd like to call this prebuilt panel several times in my main dashboard but I don't know how to set the token $titlePanel$ to have different tilte on each panel I tried this but not working     <form> <label>My Label</label> <row> <set token="titlePanel">Title 1</set> <panel id="chartPanel1" ref="my_prebuilt_panel"></panel> </row> <row> <set token="titlePanel">Title 2</set> <panel id="chartPanel2" ref="my_prebuilt_panel"></panel> </row> </form>      Is there a way to do this ? Thanks

Hello, I am trying to access DB using latin1 character as DB connector. However, the text is not output normally. I tried the following through JDBC URL in DB connection, but still no normal output. jdbc:mysql://<ip>:<port>/<database>?characterEncoding=latin1 jdbc:mysql://<ip>:<port>/<database>?useUnicode=true&characterEncoding=latin1 jdbc:mysql://<ip>:<port>/<database>?useUnicode=true&characterEncoding=utf8 jdbc:mysql://<ip>:<port>/<database>?useUnicode=yes&characterEncoding=UTF-8 could you help me?   MySQL version: 5.1

Hi All, I need your urgent help in fixing one of the issue in my PROD environment.  we have an application log which rotates twice daily. once in the afternoon and once around midnight. Logs starts feeding in splunk when log rotates around afternoon and stops feeding when log rotates around midnight. if we do some minor changes to inputs like adding any extra parameter to inputs.conf if starts feeding again and then stops again in few seconds. This is my inputs.conf [monitor:///var/log/logpath/logpath/xx*.log] sourcetype = abcd disabled = false index = xyz   this is my props.conf [abcd] SHOULD_LINEMERGE=TRUE BREAK_ONLY_BEFORE = \w\|\d+\|\d{2}:\d{2}:\d{2}\.\d{6} MAX_TIMESTAMP_LOOKAHEAD = 15 NO_BINARY_CHECK = true TIME_FORMAT = %H:%M:%S.%6N TIME_PREFIX = \w.*\|\d*\| category = Custom disabled = false pulldown_type = true TRUNCATE=50000 MAX_EVENTS = 9999 Please let me know if any other information is required here. Any help here will be highly appreciated. Thanks in advance Prateek 

I recently learned that it is best practice to use the Monitoring Console to manage our Splunk servers instead of installing Universal Forwarders on them, how then do we run a search across all of our Splunk servers Event Logs to for instance see how long each one was up for?  I have the query and I can run it against all of our other servers that do have the Universal Forwarder installed on them and it works great, but when I query the wineventlog index it finds none of our Splunk servers in it

Hello team,   we are looking for an incident management solution and wish to try out Splunk On Call but we were not able to start a trial from your product page as we are unable to submit the trial form and we get the following error    any ideas about what we might be doing wrong here?

I setup a Controller audit report on both our SaaS Controllers and received the report over email. There's nothing in the email or the report which indicates which report is for which of the two controllers. As the email is also sent as AppDynamics Reports <noreply@appdynamics.com> we have no way of telling the reports apart.

so I want to know how long our Splunk servers have been up for, I got the query and it works great on hundreds of other servers but not on our two dozen Splunk servers (Cluster Master, Deployment Servers, Indexers, Search Heads, etc.) I think it is because we do not have the Universal Forwarder installed on them, so can we install it on the Splunk servers or am I dense and missing something and we can just use some of the Splunk Enterprise component to send Even Log data to our Indexers