Hello, I am trying fetch Azure Virtual Machine Metrics data using Add on 'Splunk_TA_microsoft-cloudservices' I have  created/added azure storage account and Inputs as stated in the doc in the add on. But i dont see any logs indexed in splunk for the same.When i check the internal index i see the below error. What does it mean and How do i fix this error?   ... View more

Hi, We are using Splunk add on  Splunk_TA_windows to capture CPU,Memory,Disk and other infrastructure log details.Through this add on we are getting cpu,memory,disk all other sourcetype in Splunk for windows servers. But for only two of our windows server, except CPU & Memory other sourcetypes are being captured in Splunk.In inputs.conf of the add on  monitoring stanza in present for CPU and Memory Why we aren't receiving CPU and Memory sourcetype in those servers? How do we get those details as well?Please suggest    ... View more

Hi, I have installed Splunk DB Connect App 3.6.0 version on Splunk 8.0.5 Platform. I keep getting this error 'Cannot communicate with task server, please check your settings.' When I started to restart task server i get 'Failed to restart'. So far I have checked the following. Confirmed the java path file has correct info(/opt/app/jdk1.8.0_51) Confirmed that port 9998 and 9999 are not currently used Confirmed ports are no blocked by any firewall I have tried using other ports instead of 9998 like 1025 but still the error exists Restarted Splunk Server couple of time Also,I see the following error when I run 'index=_internal sourcetype="dbx*" *ERROR*' [ERROR] [settings.py], line 133: unable to update java path file [/opt/app/splunk/splunk/etc/apps/splunk_app_db_connect/linux_x86/bin/customized.java.path] [ERROR] [settings.py], line 89 : Throwing an exception Traceback (most recent call last): File "/opt/app/splunk/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/rest/settings.py", line 76, in handle_POST self.validate_java_home(payload["javaHome"]) File "/opt/app/splunk/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/rest/settings.py", line 215, in validate_java_home is_valid, reason = validateJRE(java_cmd) File "/opt/app/splunk/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/jre_validator.py", line 73, in validateJRE output = output.decode('utf-8') AttributeError: 'str' object has no attribute 'decode' Any solution to resolve this would be of great help. Thanks! ... View more

Hi , My Job completes at 4AM,I need to set up a alert to monitor the job status 2 hours before the job completion time i.e. at 2 AM i should start checking the Job Status if it completed or not,So starting from 2AM i should monitor and trigger the alert till the job is completed. I am using below query but it doesn't make sense and doesn't satisfies  my above condition. | makeresults | eval CurrentTime="05:00:00" | eval CurrentTimepoch=strptime(CurrentTime,"%H:%M:%S") | eval SLATIME="04:00:00" | eval SLATIMEepoch=strptime(SLATIME,"%H:%M:%S") | eval Diff=(SLATIMEepoch-CurrentTimepoch) | eval Duration=if(Diff<0, "-", "") + tostring(abs(Diff), "duration") | eval check1=case(Duration>="02:00:00" AND STATUS!=C,"Trigger",1=1,"Dont") Please help me how to capture specific time i.e. 2 AM and start checking the job status in the query? ... View more

Hi,  How can i delete the data in index after every one week? I came across Splunk answers and documents it is mentioned that we cannot completey clear index data as it depends on two attributes maxTotalDataSizeMB and frozenTimePeriodInSecs . I am confused 😕 So i am using this index data in dashboard and basically i don't want to show the old data(P.s dealing with millions of user data so sorting/deduping is not an option).Now every week new data comes to the index so when it happens i have to clear the old data existing in my index . Irrespective of whether index has reached max default size or Frozen time period or maxHotSpanSecs  has reached its value how can i set the attributes in the index so that index data is empty every week? Thanks! ... View more

Hi, Could you please explain me what happens when deployment server stops working? How does it affects data inflow from UF's? and what components can be affected if DS goes down.   Thank You ... View more

Hi, I am using dbxquery to fetch the db data ,the db data is huge hence i am using maxrows=56406002. But the query is keeping loading for 30-40 mins and later throws an error as below even though i am fetching only one year data 'Search auto-canceled' 'The search job has failed due to an error' '| dbxquery connection=XXX query="SELECT DATE, ENDDATE, BEGDA, ENDDA FROM PA2001 where BEGDA>=20160101 AND BEGDA<=20161231" maxrows=56406002 | streamstats count as SL_NO |table DATE ENDDATE BEGDA ENDDA SL_NO' ... View more

Hi, I have requirement where i need to configure the UF to send the data to two different deployment servers or in other terms to two different Splunk enterprise. We are doing this because the application team data needs to be sent to two different project 'Splunk enterprise' and here one Splunk enterprise needs audit logs and other Splunk enterprise needs Infrastructure data. Based on compliance with Company Security Policy ,Each Splunk enterprise should have the control to manage their own logs while having control over their Deployment servers. Hence please let me know  if there is any approach where i am able to configure two deploymentclient.conf in one UF and send data to two different deployment servers.   Thank You!  ... View more

Hi, My requirement is i need to pull more than 10 million data from database and index in splunk. I want to understand, if this badly affects the performance of the stack, will there be any infrastructure related issues. How can we index such huge volume of data safely into Splunk? ... View more

Hello, I want to see the default configuartion of ''phoneHomeIntervalInSecs'' in UF. I came across splunk docs/answers as per that checked in $splunk_home/etc/system/default/deploymentclient.conf in both UF and Splunk enterprise but was unable to locate it. Could you please help me with the exact location to validate the phoneHomeIntervalInSecs. Also, We are manually updating new outputs.conf in the UF in the path splunk_home/etc/apps/deployment-apps/UFtoHF/local/outputs.conf. As per the splunk docs, due to polling between Deployment server and UF the new manual updates in UF should be erased but strangely it is not been erased (even though the new outputs.conf are not present in DS) and the updates are retained. How exactly does this polling works between DS and UF ? And Why the manual updates aren't been erased? ... View more