I have a long event which I tried to extract fields from, using splunk's extract additional fields feature.  I chose comma delimited extraction and named the fields appropriately. I have 117 fields altogether and when I to display the fields with the table command, I noticed that there are a couple of data-to-field mismatches.    field3 value is replicated for field5.  field4 value is replicated for field8. Please refer the screenshot for better understanding: regex error I have checked the transforms.conf and that looks fine. I'm not sure how to get over this issue. Any help in guiding towards the right solution will be highly appreciated.  ... View more

The predefined table names in the add-on doesn't list the service ticket related table name, hence wanted to know the service ticket table name so that I can create a custom input to pull service tickets data from ServiceNow using ServiceNow add-on.  I'm not able to find this information on the servicenow website or in splunk-servicenow add-on documentation. Can someone please let me know the same? ... View more

I'm getting the error message : "Fetch roles collection failed." when I'm trying to open 'Roles' page in splunk. However, I'm able to open 'Users' without issues. Screenshot attached for reference. I'm unsure what could be causing this. Could someone please let me know on how to fix this? ... View more

I am trying to retrieve and display the user name of the logged in user as a label or a non-editable text on the dashboard.  I'm able to fetch the user name using this query (here I'm limiting this example to 'admin') - | rest /services/authentication/current-context splunk_server=local | where user = "admin" | table user This search will always return single value. I now want to display this as a label/ non-editable text on the dashboard - For example, to display on top of the dashboard like "Logged-in user : admin"  Can someone please help achieve this?  ... View more

Microsoft Azure Billing and Usage Add-on for Splunk and Splunk Add-on for Microsoft Cloud Services - for these apps, the inputs page and the configuration are not loading. It shows 'Loading' and doesn't load at all. Checked permissions and everything is set right. Can someone please help in fixing this? Update : This is mostly on the latest version of app and the latest verson of splunk (after Python upgrade). Older versions are all working fine. ... View more

Recently upgraded from Splunk 7.1* to Splunk 8.0. I had installed Splunk Platform Upgrade Readiness App version 1 before this upgrade and it was loading. However due to obvious reasons it was skipping all the tests as the Splunk version was 7.1. Hence Upgrade to the latest available version - Splunk 8. Now post this The Splunk Platform Upgrade Readiness App app is not loading the test-run panel. I'm hence unable to run and test the instance compatibility with the upcoming python 3.0. I then upgraded to the new version(version 2) of the platform upgrade app. That didn't help either. Any points on how I should proceed further to get this app loading? ... View more

Trying to formulate a Regex that would work with events something like the below one. When I tried extracting the fields, I did not get to the expected output as the field name I'm looking at is same for values of different pattern. The rex was either failing or throwing error about using duplicate field name. Sample Event entry: No machines for project Print-Demo No machines for project Kimkeen_POC No machines for project Default Project Project name: ABCD Life, Machine name:hlstocpra2, Status:STARTED, Backlog bytes:0, Last consistency:Still replicating Project name: ABCD Life, Machine name:HKWONDERSVD02, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating Project name: ABCD Life, Machine name:hlstocpraw2, Status:PAUSED, Backlog bytes:0, Last consistency:Still replicating No machines for project Print No machines for project Demo2 No machines for project Test_migrate Expected extraction and output: Looking for help in extracting the fields with all the values to be presented in individual rows. ... View more

In need of finding a way to search to compare and generate a communication-relation table which apparently seem to involve some complex logic. I have a table with two columns where one lists the servers and the other shows the list of different server that it communicates with.(how it communicates is out of scope of requirement.) Need to search for different servers that apparently communicate with one another in one or the other way. The sample image added here will explain the source and expected result tables. Please let me know if or how this could be achieved in Splunk. ... View more

Need to extract or split a filed value into different fields based on a condition/irregular pattern(or however it can be called). Attached is what I tried but it did not work. Expected output: MeterName field should be separted into one or two fields based on the field value and pattern. / works as a separator wherever exixts. The text "Low Priority" if exists, should be ignored. Possible source field value patterns and Expected extraction output : Pattern 1 : "single alphanumeric word" = Should be MeterName1 Pattern 2: "multiple alphanumeric words separated by space" = MeterName1 Pattern 3 : "single alphanumeric word" -space- Low priority = MeterName1 (while "* -space- Low priority*" ignored) Pattern 4: "multiple alphanumeric words separated by space" -space- Low priority = MeterName1 (while "-space- Low priority" ignored) Pattern 5 : "single alphanumeric word or multiple words separated by space" / "single alphanumeric word or multiple words separated by space" = MeterName1 / MeterName2 Pattern 6 : "single alphanumeric word or multiple words separated by space" / "single alphanumeric word or multiple words separated by space" -space- Low priority = MeterName1 / MeterName2 (while "-space- Low priority" ignored) Tried few other but again not the required output: | rex field=MeterName "^(?\w+\s\w+)\/(?\w+).*$" = > Matched only one entry, with result - MeterName = E20 v3/E20s v3 Low Priority MeterName1 =E20 v3 MeterName2 = E20s | rex field=MeterName "^(?\w+\s\w+)\/(?\w+.*)$" = > Matched only one entry, with result - MeterName = E20 v3/E20s v3 Low Priority MeterName1 =E20 v3 MeterName2 = E20s v3 Low Priority Can someone please help me achieve the expected result? ... View more

I have an app installed on Splunk running on a Linux machine and another copy of the same app installed on Splunk running on a Windows instance. I was able to add the app icon to the Windows instance app by following the steps mentioned here - http://dev.splunk.com/view/SP-CAAAE86#icons. But when I followed the same steps on the Linux instance, the app Icon is not being displayed. Can someone please suggest how to get the app icon on the Linux instance? Are the steps any different from those to be followed for Windows instance? If so can someone please point me to the right place, because I couldn't find one myself. ... View more