I have created a custom alert action which has 7-8 parameters. I have added few of them as below but this does not seems to be the correct way as the only last parameter is validated in this case. [validation:savedsearch] # Require parameters to be set if webhook action is enabled action.snow_webhook = case('action.snow_webhook' != "1", null(), 'action.snow_webhook.param.url' == "action.snow_webhook.param.url" OR 'action.snow_webhook.param.url' == "", "No Webhook URL specified", 1==1, null()) action.snow_webhook = case('action.snow_webhook' != "1", null(), 'action.snow_webhook.param.assignment_group' == "action.snow_webhook.param.assignment_group" OR 'action.snow_webhook.param.assignment_group' == "", "Assignment Group cannot be empty", 1==1, null()) action.snow_webhook = case('action.snow_webhook' != "1", null(), 'action.snow_webhook.param.service_offering' == "action.snow_webhook.param.service_offering" OR 'action.snow_webhook.param.service_offering' == "", "Service Offering cannot be empty", 1==1, null()) action.snow_webhook = case('action.snow_webhook' != "1", null(), 'action.snow_webhook.param.description' == "action.snow_webhook.param.description" OR 'action.snow_webhook.param.description' == "", "Description cannot be empty", 1==1, null()) action.snow_webhook.param.url = validate(match('action.snow_webhook.param.url', "^https?://[^\s]+$"), "Webhook URL is invalid") I tried to club those all in single statement like below, but this is also not working. action.snow_webhook = case('action.snow_webhook'!= "1", null(), 'action.snow_webhook.param.url' == "action.snow_webhook.param.url" OR 'action.snow_webhook.param.url' == "", "No Webhook URL specified", 'action.snow_webhook.param.service_offering' == "action.snow_webhook.param.service_offering" OR 'action.snow_webhook.param.service_offering' == "", "No Service Offering specified", 1==1, null()) Can any one help me with how to achieve this? ... View more

I have configured one input using the File-Meta Data input to monitor a log file. But I am getting below error in the file_meta_data_modular_input.log file 2018-10-25 08:03:20,519 ERROR Execution failed Traceback (most recent call last): File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\modular_input.zip\modular_input\modular_input_base_class.py", line 1083, in execute self.do_run(in_stream, log_exception_and_continue=True) File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\modular_input.zip\modular_input\modular_input_base_class.py", line 964, in do_run self.run(stanza, cleaned_params, input_config) File "D:\Program Files\Splunk\etc\apps\file_meta_data\bin\file_meta_data.py", line 619, in run file_filter=file_filter) TypeError: get_file_data() got an unexpected keyword argument 'file_filter' Any idea? I have installed the app on the SH. ... View more

How to see the indexed event wrt this input. I have configured a input to monitor one log file. But I dont see any dashboard which comes with this app. Then how can I see the events. Please provide me the SPL. ... View more

I want to monitor a log file from the below location on a Windows server. D:\Program Files\Apache Software Foundation\Tomcat 8.5\webapps\config\ However, based on the version of tomcat, the folder name changes. It could be Tomcat 6.0 or Tomcat 7.5 — etc. — on some servers. So, I tried with a different input stanza on the Universal Forwarder in the inputs.conf file. [monitor://d:\Program Files\Apache Software Foundation\Tomcat*\webapps\config\audit.log] [monitor://d:\Program Files\Apache Software Foundation\\*\webapps\config\audit.log] [monitor://d:\Program Files\Apache Software Foundation\\...\webapps\config\audit.log] None of the above options work and in the Splunkd.log file, I can see the below entry 09-28-2018 13:44:24.422 +0000 INFO TailingProcessor - Adding watch on path: d:\Program Files\Apache Software Foundation. which means it is not recognizing folder structure mentioned in input stanza. Please suggest a solution. ... View more

I have a Splunk cloud instance getting data from multiple forwarders across globe from different time zone. I do have a heavy forwarder where I am converting the time to respective server time zone using below stanza in props.conf [host::DSF-*] TZ = America/Mexico_City While viewing the dashboards, I want the data to be automatically converted into server time zone. One of the solution for this is to set the user time zone to server time zone. But this can not be done all the time as users have to see data for multiple servers at one time. So what is the best way to convert the _time field to server time zone automatically while searching. I can maintain the lookup of host and its timezone. ... View more

I have a SH in Splunk cloud environment and HF and UF in local network. There are dbinputs configured on HF to run on a daily basis. Sometimes I want to fetch the realtime data from SQL server when a dashboard is opened. So is there any way by which I can trigger the dbinput from SH in cloud to pull the recent data from SQL server? ... View more

I have a dbinput configured to pull data from SQL table on a daily basis. So I am getting few events each day in a index called A. The count of these index varies. Now on a dashboard, I want to display recent set of events from index A without asking user to select any time range. It may happen that due to some reason dbinput may not work for few days but still I need to get the latest available events from a index. Note that on a daily basis there will be multiple events coming from dbinput. ... View more

I have a folder which has multiple log files in format CalculationMgr-xxx(xx).log and EventMgr-xxx(xx).log where xx is a numeric value. I tried configuring 2 separate monitor stanza on UF to monitor these log files but it didn't work. So I have to configure a single stanza as below # Monitors CalculationMgr & EventMgr Log File [monitor://D:\Program Files (x86)\LogFiles\] disabled = false source = Log recursive = false queue = parsingQueue whitelist = (?i)CalculationMgr-\d+\(\d+\)\.log$|(?i)EventMgr-\d+\(\d+\)\.log$ _TCP_ROUTING = development_hf followTail = 0 ignoreOlderThan = 10d Now, I want to set separate source type for these 2 log files. So I tried doing this at both location UF and HF as per below configuration. But getting no success. On UF props.conf [source::.../LogFiles/EventMgr*.log] sourcetype = EventMgr1 [source::.../LogFiles/CalculationMgr*.log] sourcetype = CalculationMgr1 On HF props.conf [source::Log] TRANSFORMS-changesourcetype = set_sourcetype_calculationmgr, set_sourcetype_eventmgr transforms.conf [set_sourcetype_calculationmgr] REGEX = (?i)^CalculationMgr\S+ DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::CalculationMgr1 [set_sourcetype_eventmgr] REGEX = (?i)^EventMgr\S+ DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::EventMgr1 Any comment on what is wrong in this configuration? How can I achieve the results on Windows platform? ... View more