I followed all the steps for the APP settings and the 'Server Status' Panel is already working. However, the 'Overview' and 'Queries' panels that depend on the 'Select components' are still not working. The app shows that he does not find the result of 'QUERY, COMMAND, SHARDING, WRITE' but I already went to mongodb and increased the log level with db.setLogLevel and I already see the logs arrive at the splunk. However, he does not understand thes e components. How can I configure the components to be populated? ... View more

We are building our DataWharehouse and decided on Splunk as a data repository, but we decided to use microsoft SSIS for data mining but we have a problem. I need to create a Linked server in MSSQL for Splunk. It is possible? Do you have any guides for me to follow? ... View more

Hi everyone! we are trying to anonymize sensitive information using SEDCMD on props.conf file in the local folder but we haven't gotten success due to a weird behavior, for exemple when we have a simple log we can easily mask it but a complex one we can not SEDCMD = s/Senha:[0-9a-zA-Z]{0,32}/Senha:****/g Bellow follows the log that we consider complex: {"Bola":"2019-06-17T22:08:26.400-03:00","pato":"Arquitetura","application":"PineOnline","tatu":"ResetarSenha","result":"false", "reqId":"6276A957-0E26-439E-8418-EB7BBBA618A8","version":"","platform":"","httpStatus":"200","reasonCode":"200","url":"https://888282121:999/Path1/Path2", "metodo":"PUT","tempo":"37","userAgent":"","request": {"ip":"","host":"192.168.0.103","client":"ClientIp:888.88.0.888","application-key":"","authorization":"", "customer-hash":"PZyKLE+0ONEfqlZyLgFe7owpccZl3iCdbYqSHiqGY_78y5PSOu+5MKh_MXk84EWKh0Cl5LHXzz+nUEEMPQCOirT5Hu01PvFAerq4ncoYszS8ZIYRpvg8P+zJMfWhT0KrcNXgDPliDXLFuK_gSIydc4QCDiY4MKXRNWn2ygpiiaEletMqkRh2wFALq7Bc5E0iMItlB6jO4mPduR95u+FCPvGn5ynrdtCzjRMciRH1IaL1vtRQijOFUsurwy_L_fGP0g5BUUohPYbBKFTjkFFTiAR11s9jQD2wZ3_pUjmIRgePfkdH021k9RsQrQQ+dr0c23EyEeLd9P+HURJg==", "payload": [{"CPF":"7878787878",Senha:58586762}]},"response": {"host":"192.168.0.20","payload": []}} In our test we realized that when we use a very large payload the transformation does not occur, when we use smaller payload everything seems to work. Reference: https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata#Anonymize_data_through_a_sed_script ... View more

I have a test environment on my machine with my DEV license however any search I have to do on that Splunk after about 8 seconds ends the search stating that it has been a Partial results. I am checking for some configuration parameters in the system\local\authorize.conf file such as srchJobsQuota, srchDiskQuota, srchTimeWin but none of these options are solving the problem. Are there any restrictions to the DEV license? or some other configuration parameter that I should change? In the "Job" button when I open the options the following message is displayed: "Search auto-finalized after disk usage limit (0MB) reached." ... View more

We configured an Input in homologation and worked perfectly however when we were to implement in the production environment Input is not able to save the data inside Splunk. The Query we are using is as follows: select DATEDIFF (SECOND, '1970-01-01', Data_inicio_cadastro) as Timestamp, * from pineonline.dbo.vw_SplunkBaseClients; We are using the Input type configured to choose the TimeStampo column with the following DateTime Format: yyyy-MM-dd HH: mm: ss However in production we are receiving the following error message: 2018-06-08 21: 22: 50.466 -0300 INFO csdbx.server.task.listeners.JobMetricsListener - action = collect_job_metrics connection = AGLPNHPSQL09-PineOnline jdbc_url = null db_read_time = 34 record_read_error_count = 5312 status = COMPLETED input_name = PineOnlineBaseClient batch_size = 1000 error_threshold = N / A is_jmx_monitoring = false start_time = 2018-06-08_09: 22:50 end_time = 2018-06-08_09: 22: 50 duration = 390 read_count = 5312 write_count = 0 filtered_count = 0 error_count = 5312 ... View more

We set up an input in DbConnect and it works perfectly in our development environment but when we apply the same input to the production server it is not being able to load the data. Follow below our query: select DATEDIFF(SECOND, '1970-01-01', Data_inicio_cadastro) as Timestamp, * from vw_SplunkBaseClientes; in data format parameters we configured yyyy-MM-dd HH:mm:ss but in production we are getting the following error message: 2018-06-08 21:18:03.133 -0300 INFO c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=AGLPNHPSQL09-PineOnline jdbc_url=null db_read_time=37 record_read_error_count=5312 status=COMPLETED input_name=PineOnlineBaseCliente batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2018-06-08_09:18:02 end_time=2018-06-08_09:18:03 duration=396 read_count=5312 write_count=0 filtered_count=0 error_count=5312 ... View more