Hi Experts, Please suggest app for mulesoft monitoring. Suggest any app that using MuleSoft Anypoint Runtime Manager. https://www.mulesoft.com/platform/exchange https://www.mulesoft.com/exchange/org.mule.modules/mule-module-splunk-connector/ https://blogs.mulesoft.com/tag/splunk/ ... View more

Hi Experts, I try to install "Splunk Enterprise Security Suite" in my standalone environment. For this I follow: https://docs.splunk.com/Documentation/ES/6.0.0/Install/InstallEnterpriseSecuritySHC But when I try to follow below step: Install Enterprise Security on the deployer. Increase the Splunk Web upload limit, for example to 1GB, by creating a file called $SPLUNK_HOME/etc/system/local/web.conf with the following stanza. [settings] max_upload_size = 1000 Then I restart my splunk server, so at the time of restart it give below error WARNING: web interface does not seem to be available! Kindly suggest the right guide for installing and configuring "Splunk Enterprise Security Suite". ... View more

Hi Experts, I need to install "Splunk Enterprise Security" and "Splunk ITSI" apps. For this Python 3 is require ??? Mu current splunk version is Splunk 8.0.1 (build 6db836e2fb9e), but python version is : $SPLUNK_HOME/bin/splunk cmd python --version Python 2.7.16 Please guide me how I upgrade splunk python version. ... View more

What is the best app for monitor remote linux server? That also provide a good configuration documents, for configure in standalone and distributed env. ... View more

Hi Experts, Below is the JSON format input of my data, I want to fetch LoadBalancer name from metric_dimensions fields, but the position of Load balancer is differ in both field. I don't know how to create for loop with break in SPL, please suggest how I achieve this. { [-] Average: 0.5441528732026144 Maximum: 14.997758 Minimum: 0.000371 SampleCount: 1530 Sum: 832.553896 Unit: Seconds account_id: 522995424064 metric_dimensions: LoadBalancer=[app/nonprod-web-in-alb/bXXXXXXXXXXXXXX] metric_name: TargetResponseTime period: 300 timestamp: 2019-12-05T01:25:00Z } { [-] Average: 0.6173158354037267 Maximum: 10.601669 Minimum: 0.000397 SampleCount: 644 Sum: 397.551398 Unit: Seconds account_id: 522995424064 metric_dimensions: AvailabilityZone=[ap-northeast-1d],LoadBalancer=[app/nonprod-web-in-alb/bXXXXXXXXXXXXXX],TargetGroup=[targetgroup/preprod-portals-perf-443/aXXXXXXXXXXXXX] metric_name: TargetResponseTime period: 300 timestamp: 2019-12-05T01:25:00Z } ... View more

Hi Experts, For an app creation, I need to create my own .conf file. Please inform me How I create a custom conf file, and how I read and write data in that conf file using Python. Please inform me where I can learn Splunk Python packages, better if it in present in any youtube channel. ... View more

Hi Experts, In my Splunk distributed environment, I have one load balancer and two search heads, and one deployment server.(No Shearch head pooling server configure). I configured alert mail on both the search head, then I get duplicate alert mail from each search head. Because of high availability of get alert mail I can`t enable alert mail only on one search head server, and nor I enable alert only on deployment server. Please suggest how I get only single alerts. Thanks in advance. ... View more

Hi Experts, I am using below SQL to get the last running commands and its stats and users information. For this I make LAST_LOAD_TIME as a rising column, and execute this query in every 10 min. V$SQLAREA.LAST_LOAD_TIME, V$SQLAREA.LAST_ACTIVE_TIME But in V$SQLAREA is populating data very frequently, so using timestamp as a rising column is not a good idea, because in this scenario I lost boundary conditions event. Please suggest how I fetch all event in my Index. SELECT SESION.SID, SESION.USERNAME, SESION.PROCESS, SQLAREA.SHARABLE_MEM, SQLAREA.PERSISTENT_MEM, SQLAREA.RUNTIME_MEM, SQLAREA.FETCHES, SQLAREA.EXECUTIONS, CASE WHEN executions > 0 THEN ROUND(elapsed_time/executions,3) ELSE NULL END elap_per_exec, SQLAREA.END_OF_FETCH_COUNT, SQLAREA.LOADS, SQLAREA.FIRST_LOAD_TIME, SQLAREA.DISK_READS, SQLAREA.DIRECT_WRITES, SQLAREA.BUFFER_GETS, SQLAREA.PLSQL_EXEC_TIME, SQLAREA.JAVA_EXEC_TIME, SQLAREA.ROWS_PROCESSED, SQLAREA.COMMAND_TYPE, SQLAREA.OPTIMIZER_MODE, SQLAREA.OPTIMIZER_COST, SQLAREA.PARSING_SCHEMA_ID, SQLAREA.PARSING_SCHEMA_NAME, SQLAREA.MODULE, SQLAREA.SERIALIZABLE_ABORTS, SQLAREA.CPU_TIME, SQLAREA.ELAPSED_TIME, SQLAREA.REMOTE, SQLAREA.OBJECT_STATUS, SQLAREA.LAST_LOAD_TIME, SQLAREA.LAST_ACTIVE_TIME FROM V$SQLAREA SQLAREA, V$SESSION SESION WHERE SQLAREA.HASH_VALUE = SESION.SQL_HASH_VALUE (+) AND SQLAREA.ADDRESS = SESION.SQL_ADDRESS (+) AND SQLAREA.LAST_LOAD_TIME > ? ORDER BY SQLAREA.LAST_LOAD_TIME ASC ... View more

Hi Experts, https://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall I follow the steps given in above link for install app in distributed environment, I installed "Splunk Add on for AWS". I have 2 search head servers, but using above link its come only on single Search Head, I verified from the back-end. Is this any fault in my environment setups ? Or I need to copy the same app using linux command to the other Search Head server ? Or only one env its OK?? ... View more

Hi Experts, I am new in Splunk, especially in a Splunk distributed environment creation. For enable SSL on splunkWeb , I modified the local copy of web.conf file ( https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Webconf ), and its perfectly working fine. But to establish secure communication between in Search Head and Indexer , I modified Input.conf file https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/ConfigureSplunkforwardingtousethedefaultcertificate Is there any way to verify the communication between Indexers and search heads are secure? (Using any CLI command or any other way) . I want to verify it before installing any splunk app. ... View more

Hi Experts, I create one app for monitoring purpose, in this app I am showing stats and feature of different application. For search purpose I also added "search" in the navigation menu. For that app I created different user for watch and monitor. But in the search menu the user have options to save the search as a Alert and forward the events to the mail box using Send Mail in alert. How I restrict user to create new Alerts, what is the right way to create role and capabilities with different functionality? Thanks ... View more