Hi, I ran into the same problem and here is how I get it to work by referencing the Result tokens part in Splunk's documentation.   <Base search> | table User, EmailAddress | sendemail to=$result.EmailAddress$ from="me@example.com" ...     https://docs.splunk.com/Documentation/Splunk/8.1.2/Alert/EmailNotificationTokens ... View more

Hello, in order to have a multivalue field from the regex, make sure to tweak the fields.conf as well: TOKENIZER = Use this setting to configure multivalue fields. A regular expression that indicates how the field can take on multiple values at the same time. Otherwise, the first group is taken from each match to form the set of values. More info in the docs: fields.conf spec Hope it helps, regards.. ... View more

I had to contact Splunk support to apply these configs to my Splunk Cloud indexer. Thank you Nicolo_Figiani and somesoni2 for your help! ... View more

Sorry guys, neither of the above work. One user recommended that I try: index=foo earliest=-30m | rex field=_raw "FailureReason\=(?[\d]+)" | search FailureReason=* | stats count by host, FailureReason | where (FailureReason=24403 and count > 20) OR (FailureReason=22056 and count > 500) Which is the only one so far that works ... View more

I had exactly the same problem, the tailing processor led me to the answer... Splunk was ignoring the ERRORLOG file because I had recursion disabled. Thank you! ... View more

well explained. ... View more

This is fixed in 2.0.2. ... View more

I am using Splunk cloud and Jira cloud: I give the below details in splunk, get the error :Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/splunk-add-on-jira-alerts/admin/jira_alerts_install/jira JIRA Alert Actions Configure JIRA Alert Actions Server Server Base URL https://splunkatlas.atlassian.net/ JIRA Username JIRA Password Since Splunk cloud and Jira cloud both on cloud, I dont think there is any firewall in between is causing the problem or could be. Any similar experience advise would help. Thanks!. , ... View more

Notes this must be system local you can't include this setting in an app ... View more

Would this error the OP mentioned cause actual events to not show in the search head? I have this error popping up with the Tenable add-on and app, and do not have as much logs/events coming into Splunk as can be seen in SecCenter. Its like some of the data gets ingested, some does not. Or in this case it is ingested and in the DB, but the search head cannot list it all. ... View more

Hello there, you should install S.o.S that comes along with a custom command called btool. For example, right from Splunk search bar: | btool <conf file name> eg: | btool inputs or | btool props and so on.. Since you have also field extraction of all this, you can even filter for stanza name, app name and so: | btool inputs | search stanza="WinEventLog://Security" or | btool props | search app="Your_wonderful_parsing_app_name" The output is pefectly readable: Hope it helps.. Cheers ... View more