Hi Splunkers, in our environment we use Splunk DB connect. When we configure a new connection, on differents DBs we are facing the following error:     The error is self explaining and it will be very clear for us in a normal condition, but what sounds strange is: 1. When we confgure the connection, we do NOT use encryption; we clearely disable encryption and flag the read only parameter 2. The error rise up with many DB of the same network, but not all. 3. It has been ensured by DB team that no encryption has been set on DB servers of that network. So, my wonder is: why we face a TLS error if we are telling to SPlunk to not use it? And how to solve it?

Hello When I try to install the cluster-agent-opeartor.yaml I get the error. Error from server (Forbidden): error when creating "cluster-agent-operator.yaml": roles.rbac.authorization.k8s.io is forbidden: User "j" cannot create resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "appdynamics": requires one of ["container.roles.create"] permission(s). Thanks.

  I am not sure of how to set the BREAK_ONLY_BEFORE I have tried the below setting.. all my logs are of log4j format and starts at [2022-04-05 11:18:23,839] format BREAK_ONLY_BEFORE: date My logs are  which are send to splunk through fluentd in as different events: [2022-04-05 11:18:23,839] WARN Error while loading: connectors-versions.properties (com.amadeus.scp.kafka.connect.utils.Version) java.lang.NullPointerException at java.util.Properties$LineReader.readLine(Properties.java:434) at java.util.Properties.load0(Properties.java:353) at java.util.Properties.load(Properties.java:341) at com.amadeus.scp.kafka.connect.utils.Version.<clinit>(Version.java:47) at com.amadeus.scp.kafka.connect.connectors.kafka.source.router.K2KRouterSourceConnector.version(K2KRouterSourceConnector.java:62) at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.versionFor(DelegatingClassLoader.java:380) at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.versionFor(DelegatingClassLoader.java:385) at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.getPluginDesc(DelegatingClassLoader.java:355) at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.scanPluginPath(DelegatingClassLoader.java:328) at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.scanUrlsAndAddPlugins(DelegatingClassLoader.java:261) at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.registerPlugin(DelegatingClassLoader.java:253) at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.initPluginLoader(DelegatingClassLoader.java:222) at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.initLoaders(DelegatingClassLoader.java:199) at org.apache.kafka.connect.runtime.isolation.Plugins.<init>(Plugins.java:60) at org.apache.kafka.connect.cli.ConnectDistributed.startConnect(ConnectDistributed.java:91) at org.apache.kafka.connect.cli.ConnectDistributed.main(ConnectDistributed.java:78)

Hi Everyone, I am getting big single event through a python script from an API containing the performance data from an API but it is not autoextracting all the KV fields and i need to get those details to get the meaningful data.Also the timestamp is coming in epoch format.Below is the event format :   {'d': {'__count': '0', 'results': [{'ID': '6085', 'Name': 'device1', 'DisplayName': None, 'DisplayDescription': None, 'cpumfs': {'results': [{'ID': '6117', 'Timestamp': '1649157300', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649157600', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649157900', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649158200', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649158500', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649158800', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649159100', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649159400', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649159700', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649160000', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649160300', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649160600', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}]}, 'memorymfs': {'results': [{'ID': '6118', 'Timestamp': '1649157300', 'DeviceItemID': '6085', 'im_Free': '2.809298944E9', 'pct_im_Utilization': '83.0702196963489'}, {'ID': '6118', 'Timestamp': '1649157600', 'DeviceItemID': '6085', 'im_Free': '2.741796864E9', 'pct_im_Utilization': '83.4770099337781'}, {'ID': '6118', 'Timestamp': '1649157900', 'DeviceItemID': '6085', 'im_Free': '2.784014336E9', 'pct_im_Utilization': '83.2225932482694'}, {'ID': '6118', 'Timestamp': '1649158200', 'DeviceItemID': '6085', 'im_Free': '2.739892224E9', 'pct_im_Utilization': '83.4884879350163'}, {'ID': '6118', 'Timestamp': '1649158500', 'DeviceItemID': '6085', 'im_Free': '2.812264448E9', 'pct_im_Utilization': '83.0523485718404'}, {'ID': '6118', 'Timestamp': '1649158800', 'DeviceItemID': '6085', 'im_Free': '2.747793408E9', 'pct_im_Utilization': '83.4408727427832'}, {'ID': '6118', 'Timestamp': '1649159100', 'DeviceItemID': '6085', 'im_Free': '2.808725504E9', 'pct_im_Utilization': '83.0736754386571'}, {'ID': '6118', 'Timestamp': '1649159400', 'DeviceItemID': '6085', 'im_Free': '2.744528896E9', 'pct_im_Utilization': '83.4605457900666'}, {'ID': '6118', 'Timestamp': '1649159700', 'DeviceItemID': '6085', 'im_Free': '2.804084736E9', 'pct_im_Utilization': '83.1016422674804'}, {'ID': '6118', 'Timestamp': '1649160000', 'DeviceItemID': '6085', 'im_Free': '2.740002816E9', 'pct_im_Utilization': '83.4878214704282'}, {'ID': '6118', 'Timestamp': '1649160300', 'DeviceItemID': '6085', 'im_Free': '2.7926528E9', 'pct_im_Utilization': '83.1705349587829'}, {'ID': '6118', 'Timestamp': '1649160600', 'DeviceItemID': '6085', 'im_Free': '2.736328704E9', 'pct_im_Utilization': '83.5099629050747'}]}} In the above event , it is displaying CPU , memory utilization multiple times at different epoch times for each device.I have removed the trailing event containing data for other devices as it was exceeding the forum limit to post.I need to get the utilization data device wise.Please help on this.   Thanks

I am parsing logs using splunk and there are two types of logs : 1. API endpoint info and user ID 2. Logs which contains specific error that I am interested in.(Lets say error is ERROR_FAIL)   I need all logs for a particular user hitting endpoint and getting ERROR_FAIL. Both the logs have same request id for one instance of api call. So firstly I want to filter the request ID from point 1, which will give me request id for the api and user I am interested in, and based on that request id ,I wana see all the logs that have failed because of error(ERROR_FAIL). Now If i use following query ,I get all the request ids for user and API: index=app-Prod sourcetype=prod-app-logs "api/rest/v1/entity" " 123" | table xrid   Now if I add this in sub-search. it does not work:Final query   index=app-Prod sourcetype=prod-app-logs  [search index=app-Prod sourcetype=prod-app-logs "api/rest/v1/entity" "123" | table xrid]  "ERROR_FAIL"  |  table xrid   This does not return anything. There are logs where 123 user hits "api/rest/v1/entity" and gets "ERROR_FAIL".How can i make my query correct?

Hi there, I've a scripted lookup that returns a field which contains text data. What is really intriguing is that if the returned data contains "metadata" in it, then the text is html encoded (partially at least), and not if this keyword 'metadata' is not present. Any logical explanation to that? How can I remove this html encoding? | stats count | eval curious = "jambon: de -> bayonne" | fields curious This will result in a single field containing "jambon: de -> bayonne" as expected. | stats count | eval curious = "metadata: de -> bayonne" | fields curious This will result in a single field containing "metadata: de -&gt; bayonne" which is not expected ; why is the ">" html encoded?! I thought it was related to the fact that "metadata" is also a Splunk command, but after a few tries with "search", "metasearch",  "mcollect", etc, none of those trigger this behaviour. Is this a weird bug? I'm on Splunk 8.2.3, can you guys reproduce and on which versions? Thanks,

how do I use a regular expression to match a pattern in a logfile - I am using LogFile extension for example from the following line specific to a "Response" msg {"remoteHost":"epdg","epoch":1648084954231,"command":"Response","Result-Code",{"value":1001}},"statusCode":"2001","status":"FOO ","timestamp":"2022-03-24 03:22:34.231"}   can I use a regular expression to find statusCode NOT 2001 indicating a failure - If so what regex should I use? cant seem to find documentation  

In our environment there are 2 HF's which are sending logs from different sources to splunk indexers and external tool Qradar. So my question is suppose we have searched for any windows events for any specific timestamp, on search head and showing 20 events, so it is true that qradar will also received 20 events in same timestamp. I tried do the same seems there difference is number, so want to confirm , how it will be. If you can share any docs which says it will be same or not.