in classic dashboards - I could schedule a pdf of a dashboard to be sent to me daily but I do not see that option in dashboard studio? where is that option??   Rich ... View more

The doc mentions IT Essentials Work. Tried to download IT Essentials work but I get an error message during installation. "App Installation failed" "invalid app contents: archive contains more than one immediate subdirectory: and DA-ITSI-DATABASE" I still have the "Splunk add-on for amazon web services" version 5.1.0 running on a heavy forwarder collecting the data and sending it to my indexes on splunkcloud...   (5.2.0 is broken) ... View more

I have a redhat 7.4 syslog-ng server with splunk heavy forwarder(8.1.2)  installed. server is TZ EST Server collects udp/514 logs from multiple networking devices and writes them to textfiles like ... /syslogs/todays-internetfirewalls.txt /syslogs/todays-routers.txt /syslogs/todays-switches.txt splunk Heavy Forwarder has data/file monitor inputs for the various text files and are assigned to the appropriate index with the appropriate sourcetype so some network devices sending udp/514 syslogs to the above server are in different timezones but the entries in the text file written do not adjust for timezones... example screen attached - In screenshot IP 172.24.63.88 is GMT and 172.24.3.5 is EST I researched and tried to create an app called Timezones on the HF with a local/props.conf file that just lists... [host::172.24.63.88] TZ = GMT but when file data is ingested the _time for the IP in GMT is same as it appears in the log file entry with no adjustment to bring GMT time to EST time?? any help would be appreciated - I have read several links already and follow a few answers... https://community.splunk.com/t5/Dashboards-Visualizations/Multiple-Timezones-search-worldwide/td-p/91339 https://community.splunk.com/t5/Getting-Data-In/Multiple-time-zones-in-props-conf/m-p/286456#M54667 https://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf Rich ... View more

has anyone had success in installing UF Version 7.x or 8.x 32bit on a windows server 2008 OS some R2 some not - we have a couple servers for an old legacy application company still needs in an isolated and protected environment (legacy application not supported by vendor anymore) but they are still running old UF 6.3.8 32 bits and we have had issues with the servers when trying to upgrade to newer UF 32 bit versions... currently forwarding data to an on-prem Heavy forwarder running splunk 7.3.7 and forwarding to splunkcloud. Unfortunately the legacy application cannot be installed on server 2012 and we are stuck with 2008 32 bit we tried several options to upgrade on test server OS to 2012 and app just won't run... any known versions of 8.x running 32bit 2008 server (not supported by splunk 8.x) thanks in advance for all replies... ... View more

Thanks in advance for any responses... Scenario: I have a Heavy Forwarder Installed in my AWS environment sending my data to splunk cloud... works fine for any servers in AWS with a UF sending to HF and then to cloud We have two accounts: AccountA has a read-only access right assigned for an audit role across all services. And has read-only access to an S3 storage bucket containing all logs... AWS forwarder is an EC2 instance under this account We created a User in AccountA with With Cross-Account Assume Permission that will enable it to assume a role in AccountB with Full Read-Only Access to S3 bucket but get errors... AccountB has a logging archive role and read-only access to an S3 bucket where all logs from all services are written to the S3 bucket. what is the best way to configure the add-on to pull the logs from this s3 bucket... there are so many input options but we tried S3 Inputs/Access Logs/Generic S3 with the account and role... ... View more

I have dynamic archive storage alotment and with professional services we migrated our on-prem archive for buckets containing data up to 365 days old to archive storage however if i select archive in the indexes view I see two large indexes in particular that for some reason show data start dates in 2017 and feb 2019 (365 days retention would be october 2019). which are pushing me over my storage allotment... is there a way i can query or view (read-only) the bucket detail in dynamic archive storage (splunk S3) and their dates in order to identify which buckets have a long data span dates and request these to be removed? I have opened a ticket with support and they are investigating also... I realize that the retention removal is actually based on bucket end dates so i must have some buckets that for some reason have corrupted dates or span from 2017 or oct 2019 with end dates later than October 2019... Is there a way for the cloud admin user to query the dynamic archive storage to list data dirs to discover buckets and there individual data start and end dates...??? ... View more

Question - I have 3 node linux index cluster and linux cm we have the Splunk_TA_nix in master_apps on linux cm and it is pushed to indexers ... but i also notice that the previous installer also had the splunk_TA_nix in the /etc/apps dir on each indexer - wasn't getting updated as obviously the newer version goes into slave_apps from CM push If i want the linux os logs from indexers themselves - do I need the app in both places or can I remove the /etc/apps/ copy second question - is the best practice to just deploy the TA_nix to the forwarders and then it is not needed under slave_apps on indexer or what is the recommended practice... this TA has scripts that need to run on endpoint so i believe it needs to be deployed to all linux UF's ... View more

I have this query to list the apps and their versions last update date for apps on all index nodes, however the updated date lists a default for all apps as "1969-12-31T19:00:00-05:00". Anyway to modify this to produce the proper updated date? | rest /services/apps/local | search disabled=* |table splunk_server, title, label, version, updated, disabled, visible, description, author, configured, core, "eai:acl.app", "eai:acl.sharing", id thanks in advance for any assistance... Rich ... View more