Hi, And what about the closing keynote with Mark Hamil? Will that be available sometime in the future or the same restriction applies here too? ... View more

Old topic, but if someone experiences the same issue ... it will depend a lot on the content of the macro and the overall implementation, but for me the solution was to configure the macro to accept a single argument and in the SPL where I use the macro I enclose the arguments with double quotes. E.g. I had a macro used in dashboard, the arguments for the macro were taken from a multiselect input field on the dashboard. The input field creates a token $multipleValuesSeparatedByComma$ which I passed to the macro (the user can select one or more items in the field, thus passing one or more arguments to the macro):   myMacro($multipleValuesSeparatedByComma$)   This didn't work very well in the SPL contained in the macro when the user selected more than one value in the field. I then tried to add double quotes around the token and this SOLVED the problem, i.e.:   myMacro("$multipleValuesSeparatedByComma$")   Now the users can select single, double or multiple values and the underlying SPL understands it correctly and returns the right results. ... View more

Thanks! This is interesting, I'll try it. ... View more

I am having the same issue repeatedly in our Win'16 environment. Anyone found the cure yet? ... View more

Was this solved yet? ... View more

Splunk 8.x and Python 2.x is supposed to be a "no go" ... View more

Awesome post, thank you! ... View more

Thanks! I've found the KSconfig tool: https://splunkbase.splunk.com/app/4383/#/details It seems that it will help me alleviate the issue easily. ... View more

thanks @tauliang but the link text is missing? ... View more

Yes, What you probably do is what we did in the past - routing all syslog to our HFs on as single port, e.g. 514. Splunk serves each port with single pipeline, so if you only use one port for all your syslog, then you will use only a sinigle pipeline. Better option is to configure different ports for different syslog sources (e.g. 1514 for firewalls, 2514 for NLBs, 3515 for WAFs, etc...) BUT the BEST option is to direct all syslog traffic into Syslog-NG service and write the data into files. Then use Universal Forwarder to monitor these files. This is by far the best solution for Syslog data. ... View more

@t_walter - as far as I know it is Splunk that does not support token encryption. I've raised this as a ticket to Splunk Support and they were kind enough to explain to me that this is a missing feature currently and they will probably add it to future releases, but no commitment on exact versions or dates. ... View more

Ok, I have a workaround that seems to solve the issue...but it's dirty. The root cause is that splunkd does not search for any scripts,icons,css,whatever resources when apps are under "slave-apps". This is how it works currently, I don't know why. If you create a symbolic link with the same name under "apps" directory the problem will disappear. E.g. you have an app, called "TA-myapp" and you deploy it through the Cluster Master to "slave-apps" on the Cluster Peers. The app path would be something like "/opt/splunk/etc/slave-apps/TA-myapp". In order to solve the issue with python scripts not found, simply run the command: ln -s /opt/splunk/etc/slave-apps/TA-myapp /opt/splunk/etc/apps/TA-myapp This will create a symbolic link under "/opt/splunk/etc/apps" that points to the app under "slave-apps" and then Splunkd would be able to find the missing resource. This will fix also issues with missing icons (e.g. like in the case of some other add-ons like TA for PaloAlto). ... View more

No, I am using the Cluster Master (with its master-apps directory) and it is running on SuSE Linux. ... View more

Ok 🙂 I am trying to run scripts on all the indexers in order to do some housekeeping locally on the machine. The resulting output is collected as events, which are relatable only to the local machine, e.g. they are not "duplicate" in any sense whatsoever. Kinda like the stuff in "_internal", you know? If the peers weren't in a cluster I would've used the Deployment Server and probably it would've worked, but since the peers are part of an indexer cluster...guess I'm stuck with the master-apps method. Which gives me the issue... What you are talking about is perfectly fine, but doesn't really explain why it doesn't/shouldn't work in my case. ... View more

...but it isn't...Still getting the same results, even when the permissions are 100% same... ... View more