I have successfully implemented the Splunk Java SDK to write my own .class and implement the code within programs we run on several machines to send and retrieve data. I am able to retrieve search results as a List of <Event> or submit data to the index. However, Splunk does not format my submitted data to the main index when presented as JSON.  If I run the following code, the JSON is somehow formatted in the Splunk interface as a JSON with it's red/green formatting HOWEVER the data is not formatted through Type Event and therefore I can not search data based on an "application=test" String:   Index myIndex = service.getIndexes().get("main"); eventArgs.put("sourcetype", "_json"); String input = "{\"account\": \"test\",\"password\": \"Welkom\",\"hostname\": \"DESKTOP-KENNETH\",\"application\": \"test\"}"; myIndex.submit(eventArgs, input);   How do I need to submit a JSON where Splunk will recognize this as a Type Event with it's corresponding key/value pairs? This search will not retrieve the submitted JSON:   index=main application="test"   Type Event now has only one key/value pair: "timestamp: none".

Hi team,   i am getting below error while trying to login with splunk using java sdk. Caused by: javax.net.ssl.SSLException: java.net.SocketException: Connection reset Suppressed: java.net.SocketException: Broken pipe (Write failed)  

HI, I try to figure out a way to create a new field on a heavy forwarder. I want to add the field "splunk_parser" to every event, like the field "splunk_server", to be able to understand where an event was parsed and from which HF the event is coming. The best way would be to get the hostname from the linux machine directly. For a small amount of HF I could specify the hostname manually, but not for a bigger number of HFs. So what I came up with is this:     props.conf [host::*] TRANSFORMS-splunk_parser= splunk_parser_ext transforms.conf [splunk_parser_ext] INGEST_EVAL = splunk_parser="<hostname_HF>" fields.conf [splunk_parser] INDEXED=true      Is there a way to get the <hostname_HF> automatically assigned? with a token or extracted from the default fields?! Any hint is highly appreciated. Thank you David

Hi What is the regex for this "WFLY*:" I want to get all jboss error code start with (WFLY) and (star wildcard) till colon.  here is the sample log: 2021-07-11 23:59:02,091 ERROR APP [ACTION] WFLYEJB0034: EJB Invocation failed on component Module for method public common.platform string.platform   Any idea Thanks,

hello   I need to display a single panel with trend but it doesnt works does it miss something?   <dashboard> <label>VIZ</label> <row> <panel> <single> <search> <query>`CPU` | fields process_cpu_used_percent host | search host=06999 | stats count as "Number of peaks" by host</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <option name="useColors">1</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendInterval">-1h</option> <option name="underLabel">Compared to an hour before</option> </single> </panel> </row> </dashboard>     Thanks

This is my sentence but is not completed. I can't find the solution on Doc.   index=main sourcetype=acc* action=view [search sourcetype=acc* status=200 action=view | top limit=5 referer_domain | table referer_domain productName] | stats count,values(productName),distinct_count(productId) by referer_domain

Hello Splunkers   i want to print events for only the users who has failed login attempts but never allowed attempts. here's my search index=MyApp eventype=authentication action=fail user=* but this one prints all failures even if they have other successful attempt. i only want users with only failed attempts without other successful attempts, i hope the picture below clears things: green: user only have successful logins Yellow: user have both successful/failed logins Red: user only have failed logins   i want the red area only   Thanks

Compare the row value with the above row value , if the above row value is grater than the  present row value, it should be replaced with the above value, otherwise remains same. i have a table like the above image, you can observe date wise sum data , third row values should compare with the  second row , if it is grater than the above value it should replace with the higher value> if anyone suggest me any other method , it would be also appreciated.  i think you guys understand, what i requested , please help me out