We were asked to install the app TA-meraki on splunk. Following url were given https://splunkbase.splunk.com/app/3018/ ta-meraki_111.tgz file was downloaded and copied it to the search head server anaxsplhd01 in the path /opt/splunk/etc/apps. We unzipped the file using tar -xvzf ta_meraki_111.tgz. A folder TA-meraki was created in the path /opt/splunk/etc/apps. After that we restarted splunk. We could able to see the app TA-meraki in splunk web. We made it visible. Now user is complaining that he is unanble to see the data in the app. What steps we are missing. What are the further steps to configure the app. Following are the contents of the file /opt/splunk/etc/apps/TA-meraki/default/app.conf TA-meraki app configuration file [install] is_configured = false state = enabled state_change_requires_restart = false build = 18 [launcher] author=Myron Davis version=1.1.1 description = CIM Compliant Extractions and Tags for meraki [ui] is_visible = false show_in_nav = false label = TA-meraki [package] id = TA-meraki check_for_updates = true ... View more

Following query diplays user logon events for the last 10 days. index=main sourcetype=WinEventLog (EventCode=4624 OR EventCode=4634) user=pratapa.ln earliest=-12mon | eval day=strftime(_time,"%d/%m/%Y") | stats earliest(_time) AS earliest latest(_time) AS latest by user host day | eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S") But user wants the data to be retained for 12 months. To achieve this, we have created a new index with name "retention" with the following parameters. [retention] coldPath = $SPLUNK_DB/retention/colddb homePath = $SPLUNK_DB/retention/db thawedPath = $SPLUNK_DB/retention/thaweddb maxDataSize = 150 maxHotSpanSecs = 86400 maxTotalDataSizeMB = 54000 frozenTimePeriodInSecs = 31104000 What are the next steps that we need to follow? ... View more

A user reported that she is unable to login to Splunk with her credentials. Whereas I could able to login to Splunk with my credentials. What could be the problem. ... View more

We noticed that one of the sourcetype "wms_oracle_sessions" is missing. when we search the following queries, no results found. index=main sourcetype=wms_oracle_sessions sourcetype=wms_oracle_sessions due to which the following query is not displaying any events. No results found. index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=wk | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program How can we proceed further to get this work? Can we recreate the sourcetype? If we recreate the sourcetype, will the data be displayed? ... View more

Hi, Following query displays user logon events for the last 10 days. We need user logon events for the last 12 months. How can this be achieved. index=main sourcetype=WinEventLog (EventCode=4624 OR EventCode=4634) user=pratapa.ln | eval day=strftime(_time,"%d/%m/%Y") | stats earliest(_time) AS earliest latest(_time) AS latest by user host day | eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S") ... View more

User complained that following query is not displaying any events. index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=wk | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program what could be the problem in the above query. ... View more

Can you please let us know how long is retention for user logons in Splunk. ... View more

In our environment Nagios and Splunk are integrated. We configured an alert in Nagios monitoring tool which fetches data from Splunk but in Nagios monitoring tool, it is showing as "UNKNOWN - Error in Application name "wms" ". The alert is configured in such that it is using the script check_splunk_savedsearch_value.sh and it is taking three arguments. check_splunk_savedsearch_value.sh -a wms -s "WMOS - EW - Number of Allocation records" -w 1 [root@nagios server]# ./check_splunk_savedsearch_value.sh -a wms -s "WMOS - EW - Number of Allocation records" -w 1 UNKNOWN - no output returned from splunk.ce.corp|"wms:WMOS - EW - Number of Allocation records"=ERROR When we ran the script in debugging mode, the following command is not returning any output. [root@nagios server ]# /usr/bin/curl -s -k -u username:password https://splunk.ce.corp:8089/servicesNS/monitor/wms/search/jobs/export -d 'search=savedsearch %22WMOS%20%2d%20EW%20%2d%20Number%20of%20Allocation%20records%22' -d output_mode=csv|sed 1d [root@nagios server]# Saved search "WMOS - EW - Number of Allocation records" does exist on that search head. When we click on the saved search, Following is the error it is showing on Web page. Error in 'script': Getinfo probe failed for external search command 'dbquery' The search job has failed due to an error. You may be able view the job in the Job Inspector. Following is the search query. | dbquery "wmsewprd" "select count(*) from alloc_invn_dtl where stat_code = 11 and (sysdate - mod_date_time) * 24 * 60 > 30" When we remove | from the above search query it is showing events. Is the | in the above search query making difference ? If No, what could be the problem. dbquery "wmsewprd" "select count(*) from alloc_invn_dtl where stat_code = 11 and (sysdate - mod_date_time) * 24 * 60 > 30" ... View more

Hi, In our environment Nagios and Splunk are integrated. We configured an alert in Nagios monitoring tool which fetches data from Splunk but in Nagios monitoring tool, it is showing as "UNKNOWN - Error in Application name "wms" ". The alert is configured in such that it is using the script check_splunk_savedsearch_value.sh and it is taking three arguments. check_splunk_savedsearch_value.sh -a wms -s "WMOS - EW - Number of Allocation records" -w 1 [root@nagios server]# ./check_splunk_savedsearch_value.sh -a wms -s "WMOS - EW - Number of Allocation records" -w 1 UNKNOWN - no output returned from splunk.ce.corp|"wms:WMOS - EW - Number of Allocation records"=ERROR When we ran the script in debugging mode, the following command is not returning any output. [root@nagios server ]# /usr/bin/curl -s -k -u username:password https://splunk.ce.corp:8089/servicesNS/monitor/wms/search/jobs/export -d 'search=savedsearch %22WMOS%20%2d%20EW%20%2d%20Number%20of%20Allocation%20records%22' -d output_mode=csv|sed 1d [root@nagios server]# What could be the reason. We see that Splunk forwarder is not installed on Nagios Production server. Is Splunk forwarder needs to be installed on Nagios production server. ... View more

Can you please let us know how to get Splunk license utilization for the last 3 months. We would like to know through query. ... View more

How to check the name of the Add-on Builder in my splunk instance. ... View more