hai all How to monitor a windows service, send an alert and restart the service? what was the required configuration. ... View more

hai all, is any way to add citrix application date into splunk. please let me know if any Addon to add from  citrix receiver.   ... View more

Getting errors as Failed to start KV Store process. See mongod.log and splunkd.log for details. tried few steps by rm -rf /data1/kvstore/mongo/mongod.lock followed by restart but still showing status as failed  please let us know on this to resolve   /opt/splunk/bin #systemctl status Splunkd ● Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start' Loaded: loaded (/etc/systemd/system/Splunkd.service; enabled; vendor preset: disabled) Active: active (running) since Wed 2022-10-12 11:02:22 CDT; 9s ago Main PID: 28477 (splunkd) Tasks: 7 Memory: 111.6M (limit: 100.0G) CGroup: /system.slice/Splunkd.service ├─28477 splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd ├─28530 [splunkd pid=28477] splunkd --under-systemd --systemd-delegate=yes -p 8089 _internal_launch_under_systemd [process-runner] └─28558 /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_billing_cur.py --scheme Oct 12 11:02:24 usappslnglp100 splunk[28477]: Checking critical directories... Done Oct 12 11:02:24 usappslnglp100 splunk[28477]: Checking indexes... Oct 12 11:02:24 usappslnglp100 splunk[28477]: Validated: _audit _internal _introspection _metrics _telemetry _thefishbucket add_on_builder_index ...rts ivz_o Oct 12 11:02:24 usappslnglp100 splunk[28477]: Done Oct 12 11:02:25 usappslnglp100 splunk[28477]: Checking filesystem compatibility... Done Oct 12 11:02:25 usappslnglp100 splunk[28477]: Checking conf files for problems... Oct 12 11:02:25 usappslnglp100 splunk[28477]: Done Oct 12 11:02:25 usappslnglp100 splunk[28477]: Checking default conf files for edits... Oct 12 11:02:25 usappslnglp100 splunk[28477]: Validating installed files against hashes from '/opt/splunk/splunk-8.0.1-6db836e2fb9e-linux-2.6-x86...manifest' Oct 12 11:02:25 usappslnglp100 splunk[28477]: 2022-10-12 11:02:25.875 -0500 splunkd started (build 6db836e2fb9e) pid=28477 Hint: Some lines were ellipsized, use -l to show in full. root@usappslnglp100:/opt/splunk/bin #./splunk show kvstore-status Your session is invalid. Please login. Splunk username: admin Password: This member: backupRestoreStatus : Ready disabled : 0 guid : 45F2DDC2-C57A-4A47-B6C9-3523E0D936E6 port : 8191 standalone : 1 status : failed   ... View more

hai all, can you suggest is there anyway to ingest blookberg application data into splunk   ... View more

hai we are using multiple Heavy forwarders while doing any configuration in inputs.conf during logs collection doing manually in all heavy forwarders. is there anyway to update and push configuration for all at once  we are using deployment server to manage universal forwarders/clients. how we can use deployment to manage HF also  ... View more

Hai , we are getting data with host name as FQDN name for few linux hosts. how to get hostname so that all events should come with hostname only, let us know where can i update the config. Thanks  ... View more

Hi All, we are using Netapp cloud secure add on to collect data from cloud secure data and we have configured input but not getting all data below is the configuration please suggest if anything to add in configuration.   [cloud_secure_alerts://******] builtin_system_checkpoint_storage_type = auto entityaccessedtime = 1635795607850 index = main interval = 60 netapp_secure_insight_fqdn = ********.cloudinsights.netapp.com sourcetype = netapp:cloud_secure:alerts         ... View more

hai all, we have multiple forwarders installed nearly 1000above. we want to know if any UF stops sending data to splunk due to splunk service not running. how can i create dashboard to check if UF is not sending or client is not connected.   thanks  ... View more

Hai All, we have events from different hosts with same name. any search query to add them in single host field please suggest    dallvcrfix1p 1913 dallvcrfix1p.ops.invesco.net 20     ... View more