Yes, it does. Thank you! ... View more

You may be having the same problem here: https://answers.splunk.com/answers/518247/how-to-resolve-unable-to-initialize-modular-input.html?childToView=615146#answer-615146 ... View more

Sure @devinmclean, I've never passed for any similar event like your, but try this tips, I hope this help you. By the way, did you look the log of license master? $SPLUNK_HOME/var/log/splunk/license_usage.log to find any anomalous event? A workarround would be delete the licenses of your environment and put this again. There is some know issues and workarrounds of Splunk 7.0 release notes, see this: http://docs.splunk.com/Documentation/Splunk/7.0.0/ReleaseNotes/Knownissues [ ]s Rafael Martins ... View more

I will try this and back to you. Tks! Rafael Martins ... View more

Hi Matt, Thanks for your feedback. We tried to play with sslVerifyServerCert & require Cert wihtout luck so far. Quick question, you have mentioned SHC, do you execute ldad searches locally by setting : [ldapsearch] local = true etc or NOT ? If not, I guess ldapsearch add-on is deployed on your Indexers as well, right ? Thanks in advance, ... View more

The regex from the error message is not the same I gave you. | rex field=Object_Name "(?:[^\\]+\\){3}(?<new_field>.*?)$" | table new_field ... View more

Hi @jprs032007, I've passed for the same problem and I resolved this issue enabling the port (9998 or any that you want) in the firewall in my CentOS 7. firewall-cmd --zone=public --add-port=9998/tcp --permanent I hope help you. [ ]s Rafael Martins ... View more

Hi @grittonc, I've passed for the same problem and I resolved this issue enabling the port (9998 or any that you want) in the firewall in my CentOS 7. firewall-cmd --zone=public --add-port=9998/tcp --permanent I hope help you. [ ]s Rafael Martins ... View more

Hi, Did you try to run ldd the mi_opcua_pull binary? I got the same issue on a Red Hat 6.x, looks like mi_opcua_pull is linked to a newer glibc than I have at least. Maybe try it on Red Hat 7.x? [splunk@splunk Splunk_TA_opcua]$ ldd ./linux_x86_64/bin/mi_opcua_pull ./linux_x86_64/bin/mi_opcua_pull: /lib64/libc.so.6: version GLIBC_2.17' not found (required by ./linux_x86_64/bin/mi_opcua_pull) ./linux_x86_64/bin/mi_opcua_pull: /lib64/libc.so.6: version GLIBC_2.14' not found (required by ./linux_x86_64/bin/mi_opcua_pull) ... View more

Like this: Your Base Search Here | rex "(?=[^o]*(?:opt/chef/cache/openupf-abdirect-web-|o.*opt/chef/cache/openupf-hldirect-web-))^(?:[^\-\n]*\-){6}(?<file_version>\d+\.\d+\.\d+\.\d+\-\d+\.\d+\-\d+\-\w+\.\w+) | table _raw file_version ... View more

You'll need to keep indexers of the same cluster within one minor version of each other. So, 6.4.X indexers will be okay with 6.5.x indexers, however 6.3.x and 6.5.x indexers will not be guaranteed (and indeed 6.3.x <-> 6.5.x+ replication is intentionally broken) ... View more

You can change the port as required. Only thing is in clustered environment, you must use the updated port whereever required. I.e Enabling search head clustering , or deploying bundle from search head deployer. ... View more

Hi, I did the Dashboard below and in my case it is worked fine. For your question, only marking the searchWhenChanged parameter for false it is should be run. By the way, I put the text input instead radio button and put the searchWhenChanged = true for this. <fieldset submitButton="true"> <input type="time" token="datetime" searchWhenChanged="false"> <input type="text" token="channel" searchWhenChanged="true"> Governance <input type="time" token="datetime" searchWhenChanged="false"> <label>Date-Time</label> <default> <earliest>-5m</earliest> <latest>now</latest> </default> </input> <input type="text" token="channel" searchWhenChanged="true"> <label>channel</label> <search> <query>my_query</query> <earliest>-15m</earliest> <latest>now</latest> </search> <fieldForLabel>channel</fieldForLabel> <fieldForValue>channel</fieldForValue> <default>*</default> </input> <panel> <chart> <search> <query>index=* $channel$ | stats count by application | head 10</query> <earliest>$datetime.earliest$</earliest> <latest>$datetime.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="count">10</option> </chart> </panel> ... View more

Considering that 6.3.4 and 6.3.5 now use a new openssl version, due to new vulnerabilities found, the LDAP server needs to have the most up-to-date default cipher list in order to be approved by the splunk default cipher list. If it is not possible to update the default cipher list on the LDAP server (AD 2003 for instance is buggy and update won't be possible - SPL-109427), then following workaround should be applied: 1) obtain Ciphers configured on your LDAP server. 2) tweak TLS_CIPHER_SUITE command in etc/openldap/ldap.conf to match it. HTH. ... View more

Both fields is inside of a same node of json, or not? The content of first field displayName have a fixed size? Because if the first field have the fixed size (7 bytes), could you use this regex: (displayName:\s[A-Z]{6}) ... View more

patel, please don't post a comment as an answer. there is a link to 'add comment'. thanks. ... View more

Install the Splunk 6.x Dashboard Examples App and look at the Sankey Chart. Its a custom visualization for hierarchical data. ... View more

Hi, Have you try use this? https://splunkbase.splunk.com/app/3186/#/overview Hope i help you ... View more

Hi dennisaraujo, By default, Splunk index the file using UTF-8. All configuration about index data must be in props.conf file. Some like this: [sourcetype::testinput] CHARSET=ISO-8859-7 The configuration for the index only, is not supported for props.conf , only host, source or sourcetype . ... View more

This usually happens to me when the cluster master goes down for whatever reason. Try running 'splunk status' on the captains command line. Then perhaps you'll fine a 'splunk start' is in order. ... View more

Do this. ... | eval MB_size=byte_size/(1024*1024) | ... ... View more

I think too. I'll verify this and return. Tks! ... View more

Thanks. I'll test and return for you. ... View more