Have updated the answer. ... View more

Hello, You will not be able to do it that easily. So in the dashboard you need to have 2 panles in same row okay? First search will give you parameter Value Comments xyz 1223 abc Second search you need to format and |rename parameter as "",Value as "", Comments as "" And add it in the dashboard. Am not sure about the look and feel but this what can be done in your case as splunk doesn't have any option to remove the column header built-in ... View more

Yes 1.1.11 , jre7. both tested on jdbc 3 and 4 driver for sql server ... View more

If i use the update command on db query view e.g. update table set field=1 where value='x' it shows me some error but it updates the table. Exact error i dont remember but it's something like "Statement should return result set..". i am using sql server 2008 r2. i will make the user read only from DB level now as a work around. ... View more

Don't think so. Could pleas refer this again? _http://wiki.splunk.com/Community:TroubleshootingAlertScripts ... View more

yeah its okay, warning/error will come in splunkd.log. there is more to it. is t working now or not? Just create a file test.bat edit-> mkdir test test with this much rather than your log output. If it works or not. After that you can experiment on your own. ... View more

if you put it in D:\Splunkv5\bin\scripts , any app can access this script. If you put it in app\bin\scripts directory then only your app can access it. If you have it at both location app dir will be used. So better not be confused keep it at one location. Delete the splunkd.log. Try enabling the search again find out where the problem exactly is / >d:\test_output.txt or some other location. ... View more

did you mention SendTrapScript.bat or just SendTrapScript in the alert? or the physical file is not like SendTrapScript.bat.bat? Please check you are quite close. ... View more

I do understand splunk object level read-only permissions and DB read-only permissions. But the statement in setup page is Allows execution of non-modifying queries only. This relies on the JDBC driver's implementation of "read-only" mode. which is misleading. However i think the loophole needs to be addressed. Keep me posted please if there are any solution to this. I am quite regular here and splunk sites. ... View more

Check splunkd.log in var\log\splunk folder if you are getting error like "Cannot find script at E:\Apps\Splunk\bin\scripts\Test.bat". I have not tried it with a real time search. Try with a scheduled search to run every 1 min. My bat file created under search\bin\scripts contain only md test thats it to test. And i have tested in a realtime search also it's working. It will keep calling the script whenever result matches. Creating scripts under bin/scripts will be accessed globally by any app. arguments are not need as long as you don't use it. Try to work out the script first. ... View more

just tried in my PC, created a dummy search to run every minute. Bat file Test.bat creates a folder md Test.Every minute it creates after i delete the folder manually just outside the script directory. Am using Splunk v6.0.1. Not sure where are you getting error. Under which app your search/Alert exists? ... View more

yes please do that and add it to admin group. ... View more

In the earlier case i could see the bat file being called. So if you are able to run the file and its creating directory,could you try to run the splunkd process with you credential in windows service? ... View more

As you are using splunk v5 , there will be already a echo.bat file present in bin/script directory. Please check that one if it is creating the file echo_output.txt, if not check for permission on the directory to splunk. Create simple bat file like >md MyDir. This will verify ... View more

Using the Deployment monitor app also has all the info you need. It's a built in functionality ... View more

The concern i have is the read-only property which is given during the database connection setup. If it does depend on the role of the DB user what is the significance of the option given in the set up? Splunk objects we could control the access, but in business environment there are many factors where creating new users just to read a DB is difficult. ... View more

For other scripts you need to have the compilers installed and they should be called by a bat file e.g pyhton test.py etc. Check for the logs whether they are called properly. ... View more

If you are on windows machine, perl compiler may not be present to run the script. Bat file should run fine. If you go to Splunk\var\log\splunk\python.log you should be able to find the file is properly called or not. For now keep the bat file under bin/scripts folder. There may be permission issue creating the file, check that. Sample is here _http://docs.splunk.com/Documentation/Splunk/6.0.1/Alert/Configuringscriptedalerts ... View more

Unfortunately you have to make two groups where you want to apply crcSalt and where you dont. May be some other solution may work. You need to match the sub directory pattern through wildcard and put in some effort, but i am not sure how would it be possible to apply it. ... View more

Hello Nikhil, This is the best way, from that you can do anything. You will get the splunk result which is filtered and analyzed in a proper format. Other than this, we will have SDKs with Python,C# etc.. So it depends on you what you want to do. Other one also we have REST API call using curl. http://dev.splunk.com/view/csharp-sdk/SP-CAAAEPK ... View more

But you can't delete the metadata .It will keep showing you 7 source/sourcetype after the delete command also. it only hides the data , doesn't even free up the disk space. ... View more

if the system accepts email , you can have a configured mail alert or you can trigger a script which sends data to specific port/ whatever you want. it's in your hands what you want to do. But splunk doesn't provide anything automatically or have any ready made functionality as far as i know. ... View more