I imagine this is way too late to help you, but may be for other stumbling onto this post - splunk has an inbuilt package command: splunk package app your_app_name The app must be in the $SPLUNK_HOME/etc/apps folder of the splunk instance you run the command on, and will output to $SPLUNK_HOME/etc/system/static/app-packages Using this command should strip out any unwanted/unneeded OS level permissions and allow you to upload the app to Splunk Cloud. Some further details (not specific to the Splunk Cloud "Upload Apps" function): http://dev.splunk.com/view/SP-CAAAEMY#package ... View more

I'm not a Python expert, but from my testing on Python 2.7 I think you might just have to remove the backslash at the end of this line: isDoneStatus =isDoneStatus.search(searchStatus).groups()[0]\ ... View more

I can't pretend to know the intricacies of the automatic timestamp extraction, but I do know it's not 100% reliable. I've seen this in live environments were suddenly logs stop coming in....except they are still coming in, but the day/month has been switched so the events are in the past or the future. Anyway on your issue, if your timestamp in the log does not start at the very beginning of each event/line, you'll need to set TIME_PREFIX as well. This is a regex that should match all characters BEFORE the timestamp. If you are able to comment a couple of lines of the working and non-working logs I might be able to take a look. Use the "code sample" formatting to make sure the original formatting is maintained, and ensure there's no sensitive data in there as well. ... View more

Looks like this was resolved, you should be able to start a cloud trial with your new user now. ... View more

For anyone else stumbling across this answer - "poolsize=1 bytes" is consistent with the license Splunk Cloud provides for Heavy Forwarder, Deployment Server, and Hybrid Search hosts. In that scenario, no indexing should be occurring locally and any single event being indexed will trigger this license warning. To avoid this particular Splunk Cloud scenario, ensure your hosts are setup to forward data to Splunk Cloud, so there is no chance of local indexing occurring. If you do end up in violation, request a license reset key from Splunk Support. ... View more

The unaccepted answer in this post explains this issue well: https://answers.splunk.com/answers/643012/unable-to-distribute-to-peer-from-search-head.html ... View more

7.1.3 only has Limited availability in Cloud - You may not be able to get it. 7.2.1 is not available at all yet. The currently available version is 7.0.8.2. ... View more

You could use a scheduled saved search to output the _internal results to a lookup table - that way you have a list not limited by search timeframe (though new forwarders connecting before the populating search is run would not be listed) ... View more

Just to expand on previous comments - it is indexing for 24 hours, but the lack of AM/PM data is resulting in everything being in AM. If you source data cannot be adjusted to include more time information, then as @thomast_splunk suggests one option would be to just use the whatever the current time and date is when splunk receives the event for processing. DATETIME_CONFIG = NONE is another option: * "NONE" will leave the event time set to whatever time was selected by the input layer * For data sent by splunk forwarders over the splunk protocol, the input layer will be the time that was selected on the forwarder by its input behavior (as below). * For file-based inputs (monitor, batch) the time chosen will be the modification timestamp on the file being read. * For other inputs, the time chosen will be the current system time when the event is read from the pipe/socket/etc. This page is a good primer on how Splunk assigns timestamps if you want more details: https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/HowSplunkextractstimestamps#How_Splunk_software_assigns_timestamps ... View more

As commented by somesoni2, making an app or knowledge object available globally (All Apps) requires the admin_all_objects capability. This is not very clear from the various Doc pages, so I've submitted a request to get this clarified on some pages. ... View more

Introspection data can help here - search the found sid (search ID) in the _introspection index to get a bit more info on these searches and where they come from. Here's a quick and dirty search: index=_introspection sourcetype=splunk_resource_usage data.process_type=search data.search_props.sid=*<SID>* | transaction data.search_props.sid | table data.search_props.*,duration The provenance and app fields can help you identify where the searches are running. ... View more

This was a HEC input going to the standard endpoint, which expects data to be formatted a certain way: http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/FormateventsforHTTPEventCollector#Event_metadata It will not extract timestamps from JSON fields other than "time" in epoch format. To resolve, use the raw endpoint, which will do default field extraction as per sourcetype configuration: http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/FormateventsforHTTPEventCollector#Raw_event_parsing Hope that helps! ... View more