I am working on seeing if there is a better way that I can consume the data I have from an Azure Blob storage. I am using the Splunk Addon for Microsoft Cloud Services; which is allowing me to grab the file from the Blob storage. Now the file itself is actually a CSV; but the app does not recognize CSV to split up the data so I had to create a props.conf and transforms.conf which does allow me to get the data in and into fields.  But it turns out that the CSV fields has 1 field in it that is the rawMessage and it is actually a JSON of all the field data (and sometimes will contain a field which is not broken into a column of the CSV.  For now I am bringing all of the data in and separated into fields and then at search time doing a spath on the rawMessage field to get the other fields that only sometimes appear. What I would like to do is instead of all of the data being brought in; I want to only bring in the rawMessage field (which is JSON) and have that indexed as it has all of the data/fields. What is the best way to write the inputs/props/transforms to only read that field in and then parse it as a JSON so it will do the autobreakdown for fields? Any help with this would be greatly appreciated. ... View more

I am utilizing the Website Monitoring app and was curious if I had something wrong in my head on the credentials. I always thought that if you did not put any credentials into the Website input then it would just utilize the credentials that the splunk service runs under for the system (on a Windows server, that would be the service account running the splunkd service).  Was my thinking incorrect in this? I am asking as I have a website I am checking that my service account that runs Splunk also has access to the webpage.  When I made the input and did not put any credentials into the input then the check results were always coming back as 401.  After I went in and put the service account credentials into the website check credentials section and let it run it is now coming back with 200. If this is what is needed then we can do that but one of the main reasons we were working with teams to get them to grant the permissions to our Splunk service account was to not have to always be inputting the credentials into all of these if it would just use what Splunk runs its process as. We are currently using version 2.74 of the app. ... View more

I am trying to be able to get data in from an azure function one our of team's has done. We are not able to get the data in through our HEC endpoints as all of those are internal to our network and the azure function sits outside of our network.  So we have gone the route of trying to have the function send into an EventHub  in Azure and then we pull the data from there. using the Microsoft Azure Add-on for Splunk: https://splunkbase.splunk.com/app/3757/    But it only seems to like the standard Azure diagnostic type logged data (admin/metrics).  But not any custom error logging we are sending into that EventHub. I am not seeing any errors for the app saying it can't connect or anything but no luck getting the custom erro logs.   What is the best way to get an applications custom error logs out of an Azure EventHub? ... View more

I am trying to figure out the best way to utilize a regkey we set on Windows server which indicates the Environment the server is for.  And then being able to use that to help limit the returned search events to that type of Environment. Meaning, we have the regkey set on our test servers as test.  So i would like to be able to set something like and eventtype or tag or some other simple way where I can read that regkey on all of our Windows servers and when users go to search they could do something like: host=web* eventtype=test And all of the events for the test servers would be show in the timeframe.  And if a user instead did the search: host=web* eventtype=preprod It would show all of the event for the preprod servers. This does not HAVE to be an eventtype but just using that as a field which is indicating the registry key value without having to create some extra search just for that every time as a user.   The reading of the regkey should also be such that if a server has the regkey changed from test to preprod then that is picked up and going forward the server would show as preprod. We use to use an eventtype that was basically equal to host="*PP*" but our servers now are getting more random names so that no longer will work. Thanks. ... View more

What permissions are required to be able to save a Slideshow?  I am able to save a new slideshow as an Admin in Splunk but when a user goes through the same process it does not save it (it gives them the options to create the slideshow and do the Save function but doesn't do anything and gives no error). Thanks. ... View more

I am experiencing an issue when I have made updates to the apps on the deployer for a search head cluster and trying to push it out to the nodes. The issue seems to be hitting on DBConnect but might be that is just the app that it is hitting it on. The error I am getting is about the file being used by another process. This is the error: Error while deploying apps to first member: Error while updating app=splunk_app_db_connect on target=https://dmmsplunksh 03:8089: Non-200/201 status_code=500; {"messages":[{"type":"ERROR","text":"\n In handler 'localapps': Error installing a pplication: Failed to copy: C:\Splunk\var\run\splunk\bundle_tmp\a1f2000df5b3093c\splunk_app_db_connect to C:\Spl unk\etc\apps\splunk_app_db_connect. 5 errors occurred. Description for first 5: [{operation:\"renaming .tmp file to d estination file\", error:\"The process cannot access the file because it is being used by another process.\", src:\"C:\ Splunk\var\run\splunk\bundle_tmp\a1f2000df5b3093c\splunk_app_db_connect\bin\lib\jtds-1.3.1.jar\", dest:\"C:\Sp lunk\etc\apps\splunk_app_db_connect\bin\lib\jtds-1.3.1.jar\"}, {operation:\"renaming .tmp file to destination file \", error:\"The process cannot access the file because it is being used by another process.\", src:\"C:\Splunk\var\ru n\splunk\bundle_tmp\a1f2000df5b3093c\splunk_app_db_connect\bin\lib\rpcserver-all.jar\", dest:\"C:\Splunk\etc\a pps\splunk_app_db_connect\bin\lib\rpcserver-all.jar\"}, {operation:\"copying contents from source to destination\", error:\"There are no more files.\", src:\"C:\Splunk\var\run\splunk\bundle_tmp\a1f2000df5b3093c\splunk_app_db_conn ect\bin\lib\", dest:\"C:\Splunk\etc\apps\splunk_app_db_connect\bin\lib\"}, {operation:\"copying contents from so urce to destination\", error:\"There are no more files.\", src:\"C:\Splunk\var\run\splunk\bundle_tmp\a1f2000df5b30 93c\splunk_app_db_connect\bin\", dest:\"C:\Splunk\etc\apps\splunk_app_db_connect\bin\"}, {operation:\"copying con tents from source to destination\", error:\"There are no more files.\", src:\"C:\Splunk\var\run\splunk\bundle_tmp\ a1f2000df5b3093c\splunk_app_db_connect\", dest:\"C:\Splunk\etc\apps\splunk_app_db_connect\"}]"}]} has anyone seen this before or know how to get around it so I can push out my updates? ... View more

I am trying to figure out how I can measure the latency that my search head cluster nodes are experiencing between each other. The configuration of the search head cluster is Splunk 6.6.3, all servers are Windows Server 2012 R2, 2 of the members are in 1 data center (along with the deployer) and the other node is in another data center. The search head cluster has been up for a while and was running without any real issue. But, after this months Windows security patching and reboots, the captain fails over to a different member pretty regularly. Before, it was only failing over to another member when we were performing work on the cluster. I am figuring that the issue has to do with latency between the cluster members and want to query the metric. And if anyone has any other ideas why it might all of a sudden start having this issue (I have other stand alone search heads which got the same security patches and are having no issues). ... View more