Are these in Splunk logs or a specific application? I am assuming you will need to address the issue with the specific application's logging functionality to ensure full timestamps are being recorded that include time AND date of events. ... View more

When you download Splunk Enterprise you should have set up an admin account once Splunk starts up. This account is used for conducting administrative duties for you Splunk Enterprise deployment even when it is in trial period. You will need to login as the admin account and then give your user the admin role in Settings -> Users -> 'Your_user' -> Edit -> Assign Roles. Give your account an admin role and click save. ... View more

You are adding an extra component that is not needed if you are wanting to create a table to show PART_NUMBER, FLIT_COMPONENTS and AMOUNT. According to Splunk Docs, list() returns a list of up to 100 values of the field X as a multivalue entry. That is why you are getting multiple entries FLIT_COMPONENTS and AMOUNT for a specific field PART_NUMBER. I recommend using rename instead of stats list(field) as new_field if you are just changing field names to show in the table. You also have a by IDs at the end of your stats but then do not keep it in your table command. I would try to look at this search: ** index=ibldc-db sourcetype="flit_info" OR sourcetype="flit_comp" | dedup ID | rename FLIT_INSTRUCTION_ID as IDc, DU as DISPATCH_UNIT, BUNDLE_COMPONENT as FLIT_COMPONENTS, RULE_ID as FLIT_RULE_ID | eval IDs=coalesce(IDc, ID) | makemv IDs | table PART_NUMBER PLANT_CODE PALLET_TYPE CAPACITY FLIT_COMPONENTS AMOUNT DISPATCH_UNIT FLIT_RULE_ID UPDATED_BY ** in the table part you can feel free to add or remove whatever fields you want to show at the end of your search. Hope this helps! ... View more

Your outputs.conf looks fine to me, but I would add indexer acknowledgement to it. Add ** useACK = true ** under your tcpout:LB stanza to look like this: ** [tcpout:LB] server = idx2:9998,idx1:9998 useACK = true ** According to Splunk Docs, [splunktcp-ssl:####] is supposed to be used to receive PARSED data from a forwarder. Unless you are using a heavy forwarder that is parsing data before sending to your indexers, use [tcp-ssl:####]. See Section: Configure a TCP input over SSL I am reading conflicting statements about which stanza to use, but I know the inputs.conf.spec file states what I mentioned above about [splunktcp-ssl] vs [tcp-ssl] Other than those changes. Make sure that idx2's inputs.conf matches exactly idx1's inputs.conf (which I am sure you have). I would maybe try running a btool check and see if inputs.conf has any stanza errors. $SPLUNK_HOME/bin/splunk btool inputs list --debug on idx1. May I also suggest some strategies mentioned on Splunk Docs Troubleshoot your forwarder to indexer authentication ... View more

Can you elaborate and provide more details to what exactly you are trying to do? ... View more

You can verify the name of a created Splunk Add-on from the ** Splunk Add-on Builder ** by checking the folder name in $SPLUNK_HOME/etc/apps . Your new add on gets created here and has a header of TA . If the name of your add-on was * Add-On for Logs *, a folder gets created in $SPLUNK_HOME/etc/apps called TA-add-on-for-logs . ... View more

Currently from my investigating into this matter, there are no guides on converting advanced xml back to simple xml. Only reference I read can be found from the Changes to Splunk Enterprise *Advanced XML (deprecated in Splunk version 6.3): removed. If possible, replace Advanced XML with Simple XML. For more information about alternatives to Advanced XML available in Splunk Enterprise, see Building customizations for the Splunk platform * ... View more

Something is keeping your splunkd busy while you are trying to add this input. May need to increase splunkdConnectionTimeout which defaults to 30 seconds. I recommend reviewing your splunkd.log on that instance and if you still l cannot find the issue update $SPLUNK_HOME/etc/system/local/web.conf and increase the value of splunkdConnectionTimeout to around a minute or two. splunkdConnectionTimeout = (default 30 secs) ... View more

You are trying to add a new website input on the web_monitoring app using the Splunk Web GUI correct? ... View more