@thambisetty  thank you for suggestion. The disk quota was already 5000Mb, we increased it to 7500MB and it didn't help. Still getting the same error. Script fails as a result When we login to Splunk Cloud GUI with the user id that the scheduled script runs with - it works without giving us the error.  ... View more

@richgalloway , thank you for the idea.  The idea needs to get certain amount of votes to get attention from Splunk. I believe my questions won't get the required number.  ... View more

@txiao_splunk , thank you for providing the workaround and updating Splunk Jenkins Plugin to version 1.9.3 with disable jdk logger when console_log is disabled (https://plugins.jenkins.io/splunk-devops/) ... View more

@PavelP , thank you for the reply. Data are being sent directly to HTTP event collector, no inputs.conf exist ... View more

@txiao_splunk , thank you for your quick reply! We didn't realize that we can select "Disabled" as a "Config Item" , which we did per your advice. The goal was to stop Jenkins data from coming to index=jenkins_console (with numerous source(s) containing "console" key word ), but even after selecting "Disabled" for "Console Log" Data Source we still continued to get data in "jenkins_console" index. At this point we are not even sure if "Console log" data source corresponds to "jenkins_console" index. Any advice will be appreciated ... View more

Update: When I posted the question we were running Splunk version 7.0.5 Splunk Support engineer helped us to figure it out. Apparently the required capability for "Advanced Edit" for v. 7.0.5 is "admin_all_objects". We recently upgraded to 7.2.9 and the required capability for "Advanced Edit" for 7.2.9 is "schedule_search" as expected. The following file has the current capability: $SPLUNK_HOME/etc/apps/search/default/data/ui/manager/saved_searches_advancededit.xml: <?xml version="1.0"?> <endpoint name="saved/searches/advancededit" template="pages/system.html"> <capabilities> <read>schedule_search</read> </capabilities> </endpoint> ... View more

@13tsavage just a small update. When I posted the question we were running Splunk version 7.0.5 and apparently the required capability for Advanced Edit for v. 7.0.5 is "admin_all_objects". We recently upgraded to 7.2.9 and the required capability for Advanced Edit for 7.2.9 is "schedule_search" as expected. ... View more

@13tsavage, thank you! We found this requirement as well here https://docs.splunk.com/Documentation/SplunkCloud/7.0.5/Report/Createandeditreports#Use_the_Advanced_Edit_page_to_update_a_report_configuration The strange thing is the user is mapped to the role that has this capability "schedule_search" already. ... View more

@emeelan , Unix epoch time is the number of seconds that have elapsed since the Unix epoch, that is the time 00:00:00 UTC on 1 January 1970, minus leap seconds. So it doesn't look like human readable combination of year, date, time , but looks like a big number. We are using Splunk Cloud 7.0.13. We know that date is added to the pdf file name being emailed and we add current date to PDF dashboard itself, but management wanted to add date to Email subject:-) If you look at this documentation article "Use tokens in email notifications" ( https://docs.splunk.com/Documentation/Splunk/7.0.13/Alert/EmailNotificationTokens ) you will find a table there "Tokens available for email notification" that maps token category with alert action , scheduled reports and Scheduled PDF delivery. The table states that "Search results" and "Job information" email token categories can not be used for Scheduled PDF delivery as they are not supported. So we cannot pass $result.fieldname$ (part of Search results category) or $job.earliestTime$/ $job.latestTime$ (part of Job information category) to Email subject ! Splunk documentation states that. The only categories that can be passed to Email subject for Scheduled Dashboard PDF delivery are Search Metadata category ( $app$ , etc), Server tokens ( $server.serverName$,etc) and Dashboard metadata tokens ($dashboard.title$,etc). Not clear why people are trying to advice to use $job.earliestTime$/ $job.latestTime$ for Scheduled PDF delivery if it is not possible via use of tokens according to Splunk documentation. Look at the similar discussion at https://answers.splunk.com/answers/506310/how-to-include-earliest-and-latest-times-in-schedu.html cmerriman gave an accepted answer at Feb 27, 2017 at 06:30 AM: "For dashboards, I don't think you can access the earliest and latest time tokens for emails. http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/DashboardPDFs#Tokens_available_for_email_notifications When I have a PDF generated, the date of generation is in the attachement name and then I also have the date range as an HTML panel inside the PDF at the top. That was my workaround." and DalJeanis suggested to request an enhancement: DalJeanis ♦ · Feb 27, 2017 at 07:15 AM More... Seems like an good enhancement to request. It was 3 years ago and I thought maybe somebody found a way to add date/time to Email subject since then and posted a new question ... View more

@emeelan, not clear to me what you mean that I'm getting the unix timestamp? Please show me the timestamp that you use to convert at https://www.epochconverter.com/ I didn't provide any epoch format of time we are getting. The one timestamp I've provided here is this one "1969-12-31T19:00:02.000-05:00" and it is not in epoch format. ... View more