Hi @SloshBurch , Infact even on the License server it shows multiple server roles. And w.r.t the support request , Im not able to view any supoort cases other than those submitted by me. Have asked Jim to respond to it and yes, the query you provided does match with the license manager. ... View more

Hi @SloshBurch , Since we have a two site architecture , I mentioned both the deployment servers etc.. Yes I did edit the server roles and assigned them correctly and applied the changes and saved it. But noticed that a splunk restart on the host(deployer) brings it back to original state with those incorrect assignments. ... View more

Hi @adonio , Yes I did select it as Distributed mode. ... View more

yes , it takes 1.8 bash-4.2$ more customized.java.path /opt/applocal/asts/vendor/java/jdk/jdk1.8.0_121/bin/java bash-4.2$ ... View more

Yes the 1.7 version is needed for the other version. After I replace the old 1.7 path with the 1.8 path in the UI and click on Save of Task server settings, the dbx_settings.conf file is reflecting as below. bash-4.2$ more dbx_settings.conf [java] javaHome = /opt/applocal/asts/vendor/java/jdk/jdk1.8.0_121 But still the UI shows the error message "Unable to communicate to task server" and the app is down. I dont find customized.java.path in any of the files. I only see this commnds.conf. Where do I check for this? $SPLUNK_HOME/etc/app/splunk_app_db_connect/local/commands.conf [dbxquery] filename = customized.java.path [dbxoutput] filename = customized.java.path [dbxlookup] filename = customized.java.path ... View more

Thankyou Burch 🙂 ... View more

Hi @wcui , Second time I executed the script and I get below output , however all the DB-connections are migrated to DBX V3 so was confused what exactly do these output indicate? Traceback (most recent call last): File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/app_migration.py", line 917, in check_db_connections_conf(service_with_ns, service) File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/app_migration.py", line 260, in check_db_connections_conf connection_type_name = connection['connection_type'] File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/client.py", line 920, in getitem File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/client.py", line 915, in getattr AttributeError: connection_type Also I was trying to automate this process/upgrade. So is there a way to pass the management URI and authentication details in a single command to the script without having to provide these values in interactive mode? I meant something like splunk first time start wherin we pass "yes" and "accept license" in one command itself. "$SPLUNK_HOME/bin/splunk start --answer-yes --no-prompt --accept-license" Also , I dont find any errors for this: For example, type "https://:/servicesNS/-/-/apps" in your browser to see if there is any error. ... View more

Hi @wcui , Thankyou for your continuous guidance, but perhaps Im stuck again. Sorry to prolong on this. I get below error: Traceback (most recent call last): File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/app_migration.py", line 912, in for app in service.apps: File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/client.py", line 1247, in iter File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/client.py", line 1410, in iter File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/client.py", line 1640, in get File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/client.py", line 738, in get File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/binding.py", line 286, in wrapper File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/binding.py", line 68, in new_f File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/binding.py", line 660, in get File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/binding.py", line 1150, in get File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/binding.py", line 1202, in request File "/paas/apps/splunk/etc/shcluster/apps/splunk_app_db_connect/bin/splunk_sdk-1.5.0-py2.7.egg/splunklib/binding.py", line 1336, in request File "/paas/apps/splunk/lib/python2.7/httplib.py", line 1001, in request self.send_request(method, url, body, headers) File "/paas/apps/splunk/lib/python2.7/httplib.py", line 1035, in _send_request self.endheaders(body) File "/paas/apps/splunk/lib/python2.7/httplib.py", line 997, in endheaders self._send_output(message_body) File "/paas/apps/splunk/lib/python2.7/httplib.py", line 850, in _send_output self.send(msg) File "/paas/apps/splunk/lib/python2.7/httplib.py", line 812, in send self.connect() File "/paas/apps/splunk/lib/python2.7/httplib.py", line 1212, in connect server_hostname=server_hostname) File "/paas/apps/splunk/lib/python2.7/ssl.py", line 350, in wrap_socket _context=self) File "/paas/apps/splunk/lib/python2.7/ssl.py", line 566, in __init_ self.do_handshake() File "/paas/apps/splunk/lib/python2.7/ssl.py", line 788, in do_handshake self._sslobj.do_handshake() socket.error: [Errno 104] Connection reset by peer ... View more

Hi @wcui , Thankyou so much for your response. But how to provide the management URI as input to the scripts? , coz the scripts takes only the below inputs as per doc. app_migration.py [-h] -auth AUTH [-scheme SCHEME] [-port PORT] ... View more

Hi @ctaf , Could you please how to filter out the results such that I can view only certain fields that I want, cos this search produces loads of info. ... View more

HI @rdagan , Th e troubleshooting doc suggests how to check any issues and fix them. I understand that I can find all the error from the Splunk log files. But I'm trying to check if I can set up some monitoring for RPC Status. An alert and incident should be generated when the RPC service goes down so that we can monitor the DB Status in our clustered SH environment. ... View more

Thankyou @sloshburch , but a small query , a) Whats the difference amongst these - api_et , api_It apiStartTime apiEndTime search_lt , search_et b) What does apiStartTime='ZERO_TIME', apiEndTime='ZERO_TIME' mean? ... View more

I was wondering if I could use any ticketing/alerting tool OR Splunk itself to monitor the Splunk RPC Status. For example: Is there any specific process for RPC Status in Splunk DB Connect app , so that I could use port monitoring. I was testing in DEV Env to bring RPC Service down and noticed this action in dbx2.log "action=rpc_server_has_been_abnormally_terminated" So can I use rpc_server_has_been_abnormally_terminated as a keyboard to perform logfile monitoring on dbx2.log?? Wanted to know if this is the only keyword that occurs when RPC Service goes down? Please provide your thoughts or any ideas on ways to monitor the RPC status. ... View more

Thankyou @earlhelms 🙂 got it..!! ... View more

I didnt get this - you could provide a view to the query that you want on the database side and lock it down that way. Could you please elaborate? ... View more

Yup, I meant latest DB Connect version 2.4.0. As per the new documentation , in the permissions tab if I provide permissions to roleS say sts_monitoring_curator and sts_monitoring_user for a DB Connection_X and a user who belongs to both these roles , queries for that DB Connection , he gets an error "Unknown search command dbxquery" Yup, user A belongs to role_x and user B belongs to role_root. Its not allowing me add screenshots. Sorry, my bad I followed the old version doc. Yup I was able to achieve user A to access DB X by assigning him to role db_connect_user in the new version 2.4.0. But still quite confused with use case 2 and 3. ... View more

@sloshburch Splunk is running as stssplu1 , shown below, stssplu1 35052 1 19 Dec08 ? 02:57:19 splunkd -p 8091 restart stssplu1 35053 35052 0 Dec08 ? 00:00:00 [splunkd pid=35052] splunkd -p 8091 restart [process-runner] Unable to add images so pasting the query result: 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 INFO ulimit - Limit: cpu time: unlimited host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 INFO ulimit - Limit: user processes: 2060308 processes host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 INFO ulimit - Limit: open files: 8192 files host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 INFO ulimit - Limit: data file size: unlimited host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 WARN ulimit - Core file generation disabled host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 INFO ulimit - Limit: core file size: 0 bytes [hard maximum: unlimited] host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 INFO ulimit - Limit: stack size: 10485760 bytes [hard maximum: unlimited] host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 INFO ulimit - Limit: resident memory size: unlimited host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 INFO ulimit - Limit: data segment size: unlimited host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass 12/8/16 2:45:58.242 PM 12-08-2016 14:45:58.242 -0500 INFO ulimit - Limit: virtual address space size: unlimited host = splnkdev01 source = /opt/common/apps/vendor/splunk/forwarder/var/log/splunk/splunkd.log sourcetype = ias_bass ... View more