Can DB Connect execute an Oracle anonymous PL/SQL block, with input parameters, and get the output parameters (for indexing)? An anonymous PL/SQL block - and not a stored procedure. The later must first be created on the Oracle server. The anonymous PL/SQL block exists on the client side - Splunk - only. Is this possible with Splunk DB Connect and Oracle jdbc ?   best regards Altin ... View more

Pulling database events with Splunk DB Connect I noticed that: 1. New (non-existing) fields are created 2. text fields containing special characters  are cut The only reason I have been able to identify consists in the presence of special characters of the kind: ( ) " : ... in fields like "SQL _Text", that by their nature can contain quotes, brackets and else. How can I escape these problem-causing characters ? This done inside Splunk - and not anywhere on the DB side, or the SQL command for pulling records. What are the characters that must be escaped? Asking the later because when working in a previous project with ingesting events from a DB to Splunk via TCP Data Input, I noticed that not all special characters where causing same problem as above - but only few of them. best regards Altin  ... View more

Alerts and Reports are both persisted at savedsearches.conf . How does the UI decide that a certain entry shall be displayed under the Alerts page (../app_name/alerts) ? At Question Report v.s. Alert, what's the difference?  this is mentioned in the second paragaraph as: "while we use Alert for a Search that will make a determination to take action in contacting the outside world via email or script execution if its results match a criteria." Question 1: What are the settings that make an entry show under Alerts (and not under Reports) ? Question 2: I want to deploy the alerts of my app with sole action of "Add to Triggered Alerts" (for which I do use the setting: alert.track = 1). No email, no script . Is this possible ? ... View more

Hello At the AppInspect Report generated at splunkbase for my app: Omega Core Audit I can see the following errors:   check_meta_file_parsing ............. Duplicate stanza at line 231 in [views/oca_unf_aud_trail] of default.meta. File: metadata/default.meta Line Number: 231 Duplicate stanza at line 235 in [views/oca_dashboard] of default.meta. File: metadata/default.meta Line Number: 235 ............. check_validate_no_duplicate_stanzas_in_meta_files ............. Duplicate [views/oca_dashboard] stanzas were found. File: metadata/default.meta Line Number: 235 Duplicate [views/oca_unf_aud_trail] stanzas were found. File: metadata/default.meta Line Number: 146 .............   The issue here is: the default.meta is a file that has been fully maintained by Splunk. I have not touched it manually. Question 1: How is possible that something fully handled by Splunk is reported as an error by a Splunk Tool (App Inspect)? Question 2: How can I fix these? In case of the need to remove duplicates - which one from a couple (or more) should I delete? best regards Altin ... View more

Hello AppInspect hangs with no report produced first I logon successfully with my Splunk account, then I upload the app.tgz file. Next, the first one is a "Taking longer then expected ...", and the second is just (again) the Inspect button and a Cancel Inspection one. Splunk Enterprise Version:7.1.0 Build:2e75b3406c5b This goes on for App Inspect 1.0.4 and 1.0.6. please advise. best regards Altin PS is there an online version of App Inspect? ... View more

Hi The database connection gets disabled after some connection failures - done for normal periodic db maintenance - although the auto_disable has been set to "false". The later was supposed to stop the auto-disabling. App DB Connect vrs is 2.4 the DB Input entry is shown below - (Zs used for covering some private content):       [mi_input://ZZZZZ] connection = ORA_LIVE description = zzzzz enable_query_wrapping = 1 index = db_oracle input_timestamp_column_fullname = (003) NULL.SYSTEM_START_TIME.DATE input_timestamp_column_name = SYSTEM_START_TIME interval = 60 max_rows = 10000 mode = tail output_timestamp_format = yyyy-MM-dd HH:mm:ss query = zzzzz source = zzzzz sourcetype = oracle:fcc:audit tail_rising_column_checkpoint_value = 61393439 tail_rising_column_fullname = (001) NULL.SEQUENCE_NO.NUMBER tail_rising_column_name = SEQUENCE_NO ui_query_catalog = NULL ui_query_mode = advanced ui_query_schema = ZZZZZ ui_query_table = ZZZZZ auto_disable = false disabled = 0       Can someone advise how to keep the DB Input enabled whatever the number of failures ? best regards Altin ... View more