Hi everyone, Just wondering how to use proxy server to relay the traffic for the onprem federated search head to a splunk Cloud instance? I have a look at the federated.conf, but could not find a proxy setting? https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/Federatedconf Or should we just use the splunkd proxy settings? https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/ConfigureSplunkforproxy Many thanks, S ... View more

Hi everyone,   Recently we are trying to connect to DB2 database in z/OS.  I downloaded the JDBC 4.0 drivers and place it into /opt/splunk/etc/apps/splunk_app_db_connect/drivers/db2jcc4-libs as per suggestion in this thread: https://community.splunk.com/t5/All-Apps-and-Add-ons/DB-Connect-using-DB2-zOS-invalid-license/td-p/354081 But we still have this error:     [jcc][t4][10509][13454][4.27.25] Connection to the data server failed. The IBM Data Server for JDBC and SQLJ license was invalid or was not activated for the DB2 for z/OS subsystem. If you are connecting directly to the data server and using DB2 Connect Unlimited Edition for System z, perform the activation step by running the activation program in the license activation kit. If you are using any other edition of DB2 Connect, obtain the license file, db2jcc_license_cisuz.jar, from the license activation kit, and follow the installation directions to include the license file in the class path. ERRORCODE=-4230, SQLSTATE=42968     I have tried different version for the JDBC driver (4.16, 4.25, and 4.27).  From my understanding, if we are using a JDBC 4.0 driver, we should not need to provide a license file correct?  Also tried adding a new database type as per mention in this thread: https://community.splunk.com/t5/Archive/SPLUNK-DB-CONNECT-DB2/m-p/194145 [db2zOS] displayName = DB2 on zOS jdbcDriverClass = com.ibm.db2.jcc.DB2Driver defaultPort = 3750 connectionUrlFormat = jdbc:db2://{0}:{1}/{2} testQuery = SELECT 1 FROM SYSIBM.SYSDUMMY1; Still have no luck? Any idea?   Cheers, S  ... View more

Hi everyone, I am trying to add a custom field on every events that coming from a Heavy-Forwarder, so that from search I can know which HF the evnets are going thru. Here is my configuration in a HF: props.conf: [default] TRANSFORMS-addHF = addHF transforms.conf: [addHF] INGEST_EVAL = hf="my-hf-01" fields.conf: [hf] INDEXED=true So instead of hardcoding the hostname for every HF, I am trying to find a way to use an OS variable such as hostname in the INGEST_EVAL. Any idea how to achieve this? Many thanks. S ... View more

Hi guys, We want to onboard some data from the Cloud Storage Bucket of our GCP platform. When adding a new input, we have this error: Unexpected error "" from python handler: "(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:741)'),)". See splunkd.log for more details. I searched Splunkd log, and we have these error messages: ERROR Failed to execute function=handleList, error=Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunktalib/common/pattern.py", line 44, in __call__ return func(*args, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/resthandlers/projects.py", line 38, in handleList res_mgr = grm.GoogleResourceManager(logger, config) File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/legacy/resource_manager.py", line 51, in __init__ self._client = gwc.create_google_client(self._config) File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/legacy/common.py", line 210, in create_google_client client = discovery.build(config["service_name"], config["version"], http=http, cache_discovery=False) File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/3rdparty/oauth2client/util.py", line 137, in positional_wrapper return wrapped(*args, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/3rdparty/googleapiclient/discovery.py", line 229, in build requested_url, discovery_http, cache_discovery, cache) File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/3rdparty/googleapiclient/discovery.py", line 276, in _retrieve_discovery_doc resp, content = http.request(actual_url) File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/httplib2shim/google_auth.py", line 201, in request uri, method, body=body, headers=request_headers, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/httplib2_helper/httplib2_py2/httplib2/__init__.py", line 2135, in request cachekey, File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/httplib2_helper/httplib2_py2/httplib2/__init__.py", line 1796, in _request conn, request_uri, method, body, headers File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/httplib2shim/__init__.py", line 171, in _conn_request raise _map_exception(e) SSLError: (SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:741)'),) And this: ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 131, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 595, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunktalib/common/pattern.py", line 44, in __call__\n return func(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/resthandlers/projects.py", line 38, in handleList\n res_mgr = grm.GoogleResourceManager(logger, config)\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/legacy/resource_manager.py", line 51, in __init__\n self._client = gwc.create_google_client(self._config)\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/splunk_ta_gcp/legacy/common.py", line 210, in create_google_client\n client = discovery.build(config["service_name"], config["version"], http=http, cache_discovery=False)\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/3rdparty/oauth2client/util.py", line 137, in positional_wrapper\n return wrapped(*args, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/3rdparty/googleapiclient/discovery.py", line 229, in build\n requested_url, discovery_http, cache_discovery, cache)\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/3rdparty/googleapiclient/discovery.py", line 276, in _retrieve_discovery_doc\n resp, content = http.request(actual_url)\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/httplib2shim/google_auth.py", line 201, in request\n uri, method, body=body, headers=request_headers, **kwargs)\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/httplib2_helper/httplib2_py2/httplib2/__init__.py", line 2135, in request\n cachekey,\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/httplib2_helper/httplib2_py2/httplib2/__init__.py", line 1796, in _request\n conn, request_uri, method, body, headers\n File "/opt/splunk/etc/apps/Splunk_TA_google-cloudplatform/bin/httplib2shim/__init__.py", line 171, in _conn_request\n raise _map_exception(e)\nSSLError: (SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:741)'),)\n So is there a way to add our own CA cert to avoid the SSL error, or is there a way to turn-off SSL verification? Many thanks, S ... View more

Hi everyone, Currently we are trying to introduce indexer acknowledgement to protect against loss of in-flight data. We have a strict networking environment that only allow open port when totally necessary. Just wondering how the indexer acknowledge signal being sent to Universal Forwarders? Is there any additional port need to be opened between Universal Forwarder and Indexer? (Or between Universal Forwarder and Heavy Forwarders? ) I have a look at the below article: https://docs.splunk.com/Documentation/Splunk/8.0.0/Forwarding/Protectagainstlossofin-flightdata It says "Sends an acknowledgment to the forwarder.". But I cannot see any details at how the acknowledgement is sent? Does it send to Universal Forwarder via a management port? e.g. 8089? If we disable the management port of UFs, does it mean we cannot use this function any more? Cheers, S ... View more