Hi, I was trying to edit outputs.conf for universal forwarder, but when i was searching for outputs.conf file in etc/system/local i can see only README inputs.conf server.conf deploymentclient.conf does it means i need to change outputs.conf in deployment server ? if i need to change it in deployment server do i need change in an app ? if so what is the exact path that i can edit outputs.conf for the forwarder in deployment server please. Thanks ... View more

Hi, i want to pull data from sql server to Splunk indexer using Splunk DB Connect input for the first time i want to pull all the data at once and from next day i just want to pull only the updated rows to Splunk indexer. what are the parameters in need to set in Splunk DB Connect input? Thanks ... View more

im trying to run this query in splunk db connect input, in editor mode, the below query with order by clause is giving the errors if im running this query without the the order by clause its running perfectly select distinct ca.FCRU_Rep_Num ,ca.Queue_Date, ca.Close_Date, ca.Sar_File_Date from customer ca left join org or on ca.org = or.[Org] order by DateDiff(day, ca.Queue_Date, GETDATE( )) below is the error im getting External search command 'dbxquery' returned error code 1. Script output = "RuntimeError: Failed to run query: "SELECT * FROM (select distinct ca.FCRU_Rep_Num ,ca.Queue_Date, ca.Close_Date, ca.Sar_File_Date from customer ca left join org or on ca.org = ro.[Org] order by DateDiff(day, ca.Queue_Date, GETDATE( ))) t", params: "None", caused by: Exception(' java.sql.SQLException: The ORDER BY clause is invalid in views, inline functions, derived tables, subqueries, and common table expressions, unless TOP or FOR XML is also specified..',). " ... View more