Machine agent is not starting and crashes with an error: [Agent-Monitor-Scheduler-2] 26 Aug 2021 00:02:14,981 INFO MonitorExecutorServiceModule - Initializing the ThreadPool with size 2 [Agent-Monitor-Scheduler-2] 26 Aug 2021 00:02:14,982 ERROR PeriodicTaskRunner - Error creating environment task java.lang.ClassCastException: java.util.LinkedHashMap cannot be cast to java.util.List at com.appdynamics.extensions.conf.modules.HttpClientModule.initHttpClient(HttpClientModule.java:29) at com.appdynamics.extensions.conf.MonitorConfiguration.loadConfigYml(MonitorConfiguration.java:181) at com.appdynamics.extensions.conf.MonitorConfiguration$1.onFileChange(MonitorConfiguration.java:106) at com.appdynamics.extensions.conf.modules.FileWatchListenerModule.createListener(FileWatchListenerModule.java:37) at com.appdynamics.extensions.conf.MonitorConfiguration.setConfigYml(MonitorConfiguration.java:112) at com.appdynamics.extensions.conf.MonitorConfiguration.setConfigYml(MonitorConfiguration.java:116) at com.appdynamics.extensions.ABaseMonitor.initialize(ABaseMonitor.java:94) at com.appdynamics.extensions.ABaseMonitor.execute(ABaseMonitor.java:127) at com.singularity.ee.agent.systemagent.components.monitormanager.managed.MonitorTaskRunner.runTask(MonitorTaskRunner.java:148) at com.singularity.ee.agent.systemagent.components.monitormanager.managed.PeriodicTaskRunner.runTask(PeriodicTaskRunner.java:86) at com.singularity.ee.agent.systemagent.components.monitormanager.managed.PeriodicTaskRunner.run(PeriodicTaskRunner.java:47) at com.singularity.ee.util.javaspecific.scheduler.AgentScheduledExecutorServiceImpl$SafeRunnable.run(AgentScheduledExecutorServiceImpl.java:122) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at com.singularity.ee.util.javaspecific.scheduler.ADFutureTask$Sync.innerRunAndReset(ADFutureTask.java:335) at com.singularity.ee.util.javaspecific.scheduler.ADFutureTask.runAndReset(ADFutureTask.java:152) at com.singularity.ee.util.javaspecific.scheduler.ADScheduledThreadPoolExecutor$ADScheduledFutureTask.access$101(ADScheduledThreadPoolExecutor.java:119) at com.singularity.ee.util.javaspecific.scheduler.ADScheduledThreadPoolExecutor$ADScheduledFutureTask.runPeriodic(ADScheduledThreadPoolExecutor.java:206) at com.singularity.ee.util.javaspecific.scheduler.ADScheduledThreadPoolExecutor$ADScheduledFutureTask.run(ADScheduledThreadPoolExecutor.java:236) at com.singularity.ee.util.javaspecific.scheduler.ADThreadPoolExecutor$Worker.runTask(ADThreadPoolExecutor.java:694) at com.singularity.ee.util.javaspecific.scheduler.ADThreadPoolExecutor$Worker.run(ADThreadPoolExecutor.java:726) at java.lang.Thread.run(Thread.java:745)

I'm going to check the permission and rejection of the scan attack per hour. At this point, what I wrote... Which is appropriate, Vlaues or the list?
Also, which one is suitable, stats or stream stats? index="firewall" (action="allow" OR action="deny" ) AND ( attack="*scan") | bin _time span=1d | stats count by _time,src_ip,dest_ip,app | stats values(dest_ip) AS dest_ip , values(count) AS count by _time,src_ip,app | table _time, src_ip ,app, dest_ip , count

Hi, I have a lookupfile that contains a list of hosts, (one column named hosts), this list maybe subject to change. I want to complete a search that will compare this lookup file to hosts in any specific index and return a table showing ok or missing if there is no match. All searches I have attempted so far are happy to return either or, is the only option here to rename the field in the hostfile or any suggestions on how to complete this? host (from lookup file) host (from index) match host1 host1 ok host2   missing host3 host3 ok

I have this log { [-]    duration: 3005    finishTime: 2021-08-25T15:47:26.838196    logger: splunk    startTime: 2021-08-25T15:47:23.832269    stepTransitionDuration: [ [+]    ]    traceSteps: [ [-]      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [-]        logType: info        message: Response        res: { [-]          httpStatus: 400        }        timestamp: 2021-08-25T15:47:26.838195        title: Response      }    ]    xrayTraceId: }   How can i access only the last item (in bold letter)? I tried to access with mvindex but return blank results.

F.ex. when using NLog file target: https://github.com/NLog/NLog/wiki/File-target   What's the optimal performance way for creating log files for the Forwarder? One record per file (timestamp + guid.json)...which would create a lot of files. Or perhaps logging every second (multiple records per log file), but what about file locks? I don't want Splunk Forwarder to fight with nlog about who has a lock on the file.   What's the optimal best performance solution for creating log files to avoid file locks?

Hey Splunk gang,  I have a dashboard that I am creating and it will ingest a file every 5 minutes.  I need to create a search that will accumulate the value of an extracted field.  ie.) Extracted field = ACA, and it comes in the first time at 10, and then the second time(5 minutes later) at 15 and the dashboard displays 25.  Ideally in a single value panel.  Here is the search that produces the original value, but it does not accumulate a total: | rename "Amt Credits Acc" as "ACA" | fieldformat ACA = ("$".ACA) | table "ACA"

Hi All, we have a query as below  (index=abc OR index=def) category= * OR NOT blocked =0 AND NOT blocked =2 |rex field=index "(?<Local_Market>[^cita]\w.*?)_" | stats count(Local_Market) by Local_Market | rename count(Local_Market) as Total_Blocked | addcoltotals col=t labelfield=Local_Market label="Total Blocked" | append [search (index=abc OR index=def) blocked =0 | rex field=index "(?<Local_Market>\w.*?)_" | stats count by Local_Market | rename count as Detected_Count | addcoltotals col=t labelfield=Local_Market label="Total Detected")] Local_market    total Blocked     total detected Germany            20 ghana                   80 India                     91 total Blocked   191 Germany                                                 10 Ghana                                                       20 India                                                           10 total detected                                        40 i want data like Local_Market        Germany   ghana   India   Total total Blocked         20                80           91      191 Total Detected      10               20            10       40

I have the following sourcers: "inserted" and "deleted" In the "inserted" i have these fields: Id, Timestamp 1, 2021-08-18T19:39:31.3003273 2, 2021-08-18T02:25:05.786293 3, 2021-08-18T19:39:31.301158 etc.... In the "deleted" I have the same fields: Id, Timestamp 1, 2021-08-18T19:39:31.3003234 1, 2021-08-18T19:28:00.8425431 1, 2021-08-18T19:27:07.2603396 2, 2021-08-18T18:57:52.3556542 2, 2021-08-18T15:06:19.3365628 3, 2021-08-18T15:06:02.5264226 3, 2021-08-18T12:06:29.5371453 3, 2021-08-18T11:55:40.7562728 3, 2021-08-18T03:22:06.3672773 I need to filter the events in the 'inserted' that are newer than in the 'deleted', where the Id's are the same in both sourcers and the timestamp in the 'inserted' is greater than the Timestamp in the 'deleted'. I've managed to set up a search for one ID and manually setting the last timestamp that I found in the 'deleted', as per below:     index=something source=inserted Id=1 | eval data_inserted = strptime('Timestamp', "%Y-%m-%dT%H:%M:%S.%Q") | eval data_deleted = "2021-08-18T19:39:31.3003234" | eval data_deleted = strptime('data_deleted', "%Y-%m-%dT%H:%M:%S.%Q") | where data_inserted > data_deleted     My goal and help needed is on how to do this automatically for the IDs and Timestamp I have in the source='deleted'. Your help is very much appreciated. Thank you!