Apologies as I got confused on the wordings, here it is: Incorrect path: /Applications/Splunk/etc/apps/my_app/local/bin/run_it.sh Your script location: /Applications/Splunk/etc/apps/my_app/bin/run_it.sh Have you tried running the commands below already for checking? $SPLUNK_HOME/bin/./splunk list monitor $SPLUNK_HOME/bin/./splunk cmd btool check $SPLUNK_HOME/bin/./splunk cmd btool check --debug ... View more

Hello @eregon First time encountering the word splunkthiasts. 🙂 My answer would need you to hop on several links btw. Below link is similar to your query which the main requirement is to anonymize the data but would need to be used as non-anonymized too for different use: https://answers.splunk.com/answers/824299/anonymize-data-from-json-file.html As I've suggested to check the link below, common perception for somewhat-replicated data would be a double-hit license usage" https://answers.splunk.com/answers/690291/one-source-to-two-indexes.html Similarly, you can actually achieve the "one data (anonymized and non-anonymized) to two indexes solution" without hitting a double license usage: (check woodcock's answer on the link below) https://answers.splunk.com/answers/567223/how-to-send-same-data-source-to-two-or-multiple-in-1.html Hope it helps! ... View more

Hello @AnujaJ Though I haven't tried this yet, I think this can be achieved by forwarding the anonymized event at index-time to the intended customer index and forward a separate non-anonymized event on an admin-only index. Caveat for this is it would double your license usage. Please see link below if my answer is what you're aiming for: https://answers.splunk.com/answers/690291/one-source-to-two-indexes.html EDIT: You can actually achieve the "one data source (anonymized and non-anonymized) to two indexes solution" without hitting a double license usage: (check woodcock's answer on the link below) https://answers.splunk.com/answers/567223/how-to-send-same-data-source-to-two-or-multiple-in-1.html Hope it helps! ... View more

Hello @jaimelopez Aside from both A and B's KPI Importance value set to 11, may I know if you've set entities on them and what are the thresholds of A and B KPI? While the condition on "KPI A" was met while "KPI B" did not, my hunch is that they both have different thresholds set and should you have defined entities for both KPIs, did you split the aggregation of data by entities? ... View more

Hi @abhi04 Though I'm not quite sure if there's a best practice on implementing HEC for Distributed deployment, you can apply persistent queues to improve the data input process and potentially prevent data loss. Please see link below for more information regarding this: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Usepersistentqueues ... View more

To add, I'm not sure if there's a significant difference if you'll not use the runtime of the searches itself. Check this out also: https://answers.splunk.com/answers/235005/including-search-run-time-in-search-results.html ... View more

Hello @SLSorensen Looks more like a browser issue than Splunk. Have you tried using a different browser? or cleared the cache of your current browser? or checked the browser Developer tools (assuming you're using Chrome) and see if it will show some error before and after the page goes blank? ... View more

hello @gcusello I don't like automatic lookups so as not to lose the thread of logic of a search. About this one worst practice, I understand that this facility has a performance impact but this is always being catered on the intro courses. What alternatives will you recommend should we avoid automatic lookups aside from using | inputlookup ? Sorry for this question under a comment. ... View more

you cannot search anything on the SH (assuming no data on index=apache) but you see traffic logs (assuming the forwarder is already connected to the indexers) have you tried checking on splunkd.log if there are any errors? are the sources being monitored? (run ./splunk list monitor on the UF) ... View more

Hello @wwhite12 Place the bin outside the local directory. The run_it.sh script should be located inside the $SPLUNK_HOME/etc/apps/my_app/bin/ for Splunk to be able to run it. If bin is not existing, you just have to create it and place the script inside with atleast a chmod u+x run_it.sh permission. Hope it helps! ... View more

Hello @edgarsilva01 I believe the question is more on user's operating system rights/permission to modify the UF. As the admin or root user has all the rights to uninstall/delete a UF in most cases, you may need to set a governance should the said user be assigned as admin/root or not. Linux: Best practice on UF installation is to not install it as root. Try to set a splunk:splunk (user:group) for this and set permissions for this splunk-specific user:group. https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/RunSplunkasadifferentornon-rootuser Windows: Though I'm not very particular on Windows installations but UF is installed as Admin in most cases. Then from here, user rights can be managed on AD. Should the UF was installed on a non-admin user, the forwarder installs and runs in "low-privilege" mode. https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller Hope it helps! ... View more

sorry for bumping up this question/answer. @amitgg will you kindly share the solution and steps on how did you do this? this will help everyone that's seeking this kind of integration. Many thanks! ... View more

Hello @kiranhar See this link below: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchanges You're not supposed to deploy apps directly on a Search Head Cluster using the Deployment Server. Let me know if this is not the case. Thanks! ... View more

Hello @kiranhar are you trying to deploy an add-on using Deployment Server on a Search Head Cluster? ... View more

Can you try importing your csv file using Lookup File Editor App? ... View more

Hello @joshuabiggley, Do you have steps on getting in NPM data to Splunk? ... View more

Hello @navd You may refer to this link to access the field extractor, Or you can extract fields using regex. See link. Also, if the provided sample event is in uniform with the succeeding events, try this query: your base search | rex "\ERROR ERROR - - - - (?<Exception>.*)\:" Hope it helps! ... View more

Hello @hgehrts_splunk, I would like to use the add-on as much as possible to configure the integration faster. Base on the add-on's details, it's using dummy values for the OIDs as an example which I am confused. I found this link which tells me the Splunk Enterprise OID is 27389. The documentation used "1.3.6.1.4.1.27389.1.1" . Is this constant or configurable or where can I find this if ever? From what I understand on SNMP, the one who sends the data is the one who provides the OID. ... View more