When we call a dbxlookup in a search query, does the lookup search for the matching filed values in the entire database. While creating a dbxlookup , we just mention the matching fields and the output fields. ... View more

Hi, I have recently installed DB connect app in the search head cluster and the following message is being displayed in the search heads. DB Connect is running in SHCluster! Some functions will be disabled under this environment. What are the functions that are disabled in the app while running in the search heads ? Thanks ... View more

Hi, We have recently upgraded Splunk license to unlimited and it shows the pool size as zero. As a result everyday at midnight error messages are generated each for each indexer saying the pool size =0 . But the indexing is not stopping and Splunk is working the same and great. How can we reduce the error messages in Splunk. Thanks ... View more

Hi, we have a deployment server and some forwarders pointing to it. We might have to migrate the deployment server to a new one as the Old server needs to go down. What is the best process to migrate the deployment server ? Will the clients re-download the apps or will there be duplicate set of apps in the clients after pointing to the new server ? ... View more

We have data coming from lots of universal forwarders and it has various sources and sourcetypes and sending data only to a single index. we don't have access to inputs.conf. How can we redirect the data to a different index. Can we use transforms.conf to work on that particular index (i,e changing index name for data based only on existing index ) ... View more

Hi, we have a dev and prod cluster , both have different license masters. can we upload the same license file on both the clusters, Or else, is it okay to add the dev indexers as slaves for the prod license master. ... View more

Hi, How do we relocate the KVstore on to a new location in a search head cluster. I heard that there are some settings on the server.conf which would help in relocating the KVstore but what is the safest way to do it in a cluster without causing any KV store errors ?? Thanks ... View more

Hi, I see that Splunk App for Salesforce relies on the Addon for the data inputs and the event types and the sourcetypes are assigned automatically to the data and the Splunk App for salesforce works based on that sourcetypes or the eventtypes. How to extend the App to multiple accounts, What are the changes that are needed to be done, If we add more inputs it will merge into the existing data and is not feasible. Thanks N ... View more

Hi, We have turned on the input for the event logs in the Splunk addon for salesforce and the input stopped collecting data and showing the following error. 2018-05-02 20:55:01,639 +0000 log_level=ERROR, pid=106988, tid=MainThread, file=engine_v2.py, func_name=start, code_line_no=56 | [stanza_name=xxxxxxxxxx] CloudConnectEngine encountered exception Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/core/engine_v2.py", line 51, in start for temp in result: File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/core/job.py", line 87, in run contexts = list(self._running_task.perform(self._context) or ()) File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/core/task.py", line 535, in perform self._post_process(context) File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/core/task.py", line 234, in _post_process 'post') File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/core/task.py", line 218, in _execute_handlers data = handler.execute(context) File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/core/task.py", line 32, in execute result = callable_method(*args) File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/cloudconnectlib/plugin/cce_plugin_sfdc.py", line 94, in read_event_log_file for row in csv_reader: File "/opt/splunk/lib/python2.7/csv.py", line 108, in next row = self.reader.next() Error: line contains NULL byte How to troubleshoot ? Thanks ... View more

Hi, Suppose we have a license of 500 GB/day. we have added a new license file of 750 GB/day. Why does the total go upto 500 + 750 = 1250 GB/day. Can two licenses be active at the same time. So, can we index without errors for upto 1250 GB/day ?? Or should we delete the old file ... View more