FYI and perhaps this will be helpful to others. I was getting all the same errors and finding little of use in the log files. In my case the problem was that something had deleted these files: C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\windows_x86_64\bin\dbxquery.exe C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\windows_x86_64\bin\server.exe Files of the same name still existed under: ...\windows_x86\bin ...\linux_x86\bin ...\linux_x86_64\bin So we suspect some antivirus or similar must have deleted them for some reason. As soon as I put them back DB Connect was fine. ... View more

great answer, was very useful, thanks. ... View more

The cause of this is, when using an SH Cluster, you are suggested initially to use the flag for not overwriting lookups (preserve_lookups) - the issue is that in 5.0.1 the automatic lookups for the Windows TA changed from using sourcetype to using source (since sourcetype is being consolidated in the app). For more information on this change, see this article: https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/UpgradeFromEarlierVersions#Upgrade_saved_searches The solution to remedy this is to either: Update the lookup file manually on the SH members GUI via file upload, which is "windows_apps.csv" Update the lookup file manually on the SH members GUI via search (see this answer from woodcock https://community.splunk.com/t5/All-Apps-and-Add-ons/After-Updating-the-Add-on-for-Windows-receive-error-quot-Could/m-p/454989/highlight/true#M55987) ... View more

Could you please tell me how I can set the email subject dynamically? ... View more

Yeah, the doc team was really responsive when I reached out once before. I just wanted to make sure it's actually an error and not just a case of Idiot User. ... View more

Thanks, that solves the problem I've been struggling with. ... View more

I notice that both your queries above say "span=1h". Is the second one - the one with the lower result - supposed to be "span=1d"? If so, here's a possibility: For span=1h, it counts the distinct Session IDs in each hour and sums them up. For span=1d, it's counting all the distinct IDs in the day. Let's say you have Session ID 12345 that appears at 2 pm and at 7 pm. Perhaps with span=1h it gets counted twice - once for the 2pm span and once for the 7 pm span. But with span=1d it just gets counted once. ... View more

I don't see how this "works in regex101"? The match ends somewhere in the middle of the query: https://regex101.com/r/EQXG0e/1 This might work: ,"sql_queries":".*?," https://regex101.com/r/EQXG0e/3 (as double quotes seem to be escaped inside the query), but not sure if that is perfectly reliable, I don't have access to pastebin here, so can only see the small sample put into regex101 by one of the other commenters. And can you share in what sense it is not working in Splunk? Is it not stripping anything, or is it stripping too little / too much in certain cases? ... View more

Perfect, thanks! That gives me a good option to filter it out at collection type. The filter is a bit of an interesting challenge. I only caught this because one of the common mount points - /mnt - showed up in the data, but we've got NFS filesystems on various mount points other than /mnt. It looks like the filesystems we'd want to include always start with /dev, so a piped command like | egrep '^\/dev' would catch them all. I took a look at a Linux server (we don't have that many), and it looks like the ones which don't start with /dev are already being filtered out by your egrep -v : $ df -k -P Filesystem 1024-blocks Used Available Capacity Mounted on /dev/mapper/root xxx xxx xxx 32% / devtmpfs xxx xxx xxx 0% /dev tmpfs xxx xxx xxx 0% /dev/shm tmpfs xxx xxx xxx 3% /run tmpfs xxx 0 xxx 0% /sys/fs/cgroup /dev/mapper/lvol0 xxx xxx xxx 19% /fs1 /dev/sda1 xxx xxx xxx 26% /boot tmpfs xxx 0 xxx 0% /run/user/1417441623 tmpfs xxx 0 xxx 0% /run/user/995 ` Alternatively, I see a -T local flag in the AIX df command that takes care of it nicely; I'm not familiar enough with the Linux version though (maybe -x). ... View more

I apologize @ranazar. In moving @adonio's comment to an answer, I accidentally deleted a comment thread. Newb move. My bad!! ... View more

This Reddit post has this from user ItsJohnLocke: j.ho answered this over in the Slack channel with the following: "Looks like it was introduced to fix SPL-72576: Results differ between stats/chart/timechart and tstats when grouping by a multivalued field with duplicate values per event" I got the same answer from a Splunker that I talked to: apparently this was a bug with datamodels in a previous version of Splunk, and people generally keep this in their searches even though they're not sure if it's still needed anymore. I usually see dedup_splitvals=t in tstats searches that have prestats=true - something like: "| tstats values(field) as field from datamodel dm prestats=true | stats dedup_splitvals=t etc . If you remove "prestats=true" then the data shows up in stats form, so ... do you really need the subsequent stats command? ... View more

Thanks - I wasn't sure if it was something I had screwed up. I'll poke them with a support case and see what happens. ... View more

Hi ! The new release of the core application has been submitted for Splunk certification, and will be available on Splunk base as soon as it would be certified. In the meantime, you can download the release directly from Github. All other components, TA-nmon, nmon-logger, etc, are all update to date in their master branches. Fell free to inform me if you have any issue with the new releases. Regards, Guilhem ... View more

I too would also like to know if this is available. We used the current Mcafee addon with EPO v4 and we do get results, but it would be nice to have a v4 addon that is supported. ... View more

Perfect! I'm probably being overcautious (for a bunch of reasons), but this solution is exactly what I need. I also discovered that my system owner won't be separating his Cisco syslog data, so the combination of a unique sourcetype and the default transforms in the app should get me to Happy Days. ... View more