Hello, I have data collected through a Splunk HEC on a Heavy Forwarder. The data has this structure: 2023-03-16T16:59:01+01:00 serverIP event_info [data1][datat2] {json_data}. I want to get the json_data indexed as raw data. I have tried several regex with SEDCMD. I have tried several regex that are all working on a standalone Splunk but they have no effect with the configuration Splunk HF->Splunk IDX Here is my latest SEDCMD: SEDCMD-json=s/^[^{]+//g Currently there is no TA on the Splunk indexer and I am wondering if this is the cause of the issue. Is SEDCMD compatible with HEC ?  Regards ... View more

Hello, I have several HFs. I would like to set a new metadata HF_x to identify the HF server. In the /opt/splunk/etc/system/local/inputs.conf I added _meta = server_hf::server1 After restart of the HF, I noticed that this new metadata is set on the events of the _internal index but not on the events that were retrieved by dbconnect. Could you tell me if it is possible to define a new metadata on a HF and have it associate to the events retrieved by DB connect or modular input? Regards ... View more

Hello, I am trying to install a modular input. On a standalone Splunk, there is no problem, the setup dashboard shows up perfectly. But on an heavy forwarder I get the following error on the graphical interface of Splunk: Unable to initialize modular input "gmail_bigquery" defined inside the app "TA_AI_NR_1R93_gmail_HF": Introspecting scheme=gmail_bigquery: script running failed (exited with code 1). And in the _internal index: 05-13-2019 15:21:53.237 +0200 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last): \n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 130, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 594, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/apps/TA_AI_NR_1R93_gmail_HF/bin/ta_ai_nr_1r93_gmail_hf/splunk_aoblib/rest_migration.py"spl , line 38, in handleList\n AdminExternalHandler.handleList(self, confInfo)\n File "/opt/splunk/etc/apps/TA_AI_NR_1R93_gmail_HF/bin/ta_ai_nr_1r93_gmail_hf/splunktaucclib/rest_handler/admin_external.py", line 40, in wrapper\n for entity in result:\n File "/opt/splunk/etc/apps/TA_AI_NR_1R93_gmail_HF/bin/ta_ai_nr_1r93_gmail_hf/splunktaucclib/rest_handler/handler.py", line 118, in wrapper\n raise RestError(exc.status, exc.message)\nRestError: REST Error [404]: Not Found -- HTTP 404 Not Found -- {"messages":[{"type":"ERROR","text":"Not Found"}]}\n It seems that something is missing in the configuration but I do not find what it could be .... Cheers Céline ... View more

Hello, I am trying to install a modular input. On a standalone Splunk, there is no problem, the setup dashboard shows up perfectly. But on an heavy forwarder I get the following error: +200 ERROR AdminManagerDispatch - Cannot call handler 'TA_xxx' du to missing script 'my-script.py'. The script is present in TA/bin/my_script.py The TA/local/restmap.conf contains the stanza: [admin_external:TA_string] handlertype = python handlerfile = my_script.py handleractions = edit, list, remove, create If anyone has a small idea ... Cheers Céline ... View more

Hello, I have a log with a timestamp that does not contain the year. Moreover the events are not in a chronological order. Here is a sample: %symavsfs-4: Thu Mar 08 12:16:23 Romance Standard %symavsfs-4: Thu Mar 08 12:18:25 Romance Standard %symavsfs-4: Fri Dec 15 00:12:45 Romance Standard %symavsfs-4: Fri Dec 15 00:17:50Romance Standard The timestamp extraction gives an error: A possible timestamp match (Thu Mar 08 12:16:23 2019) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. I try to put MAX_DAYS_AGO to 2000 (but it is supposed to be set by default), and MAX_DIFF_SECS_AGO to 31536000 (1 year in second). But the extraction is still not correct. Splunk understands that the events are in the future. Does anyone know how to force Splunk to consider that the events are in the past, either in 2018 or in 2017 ? Regards Céline ... View more

Hello, I am using a custom splunk command and I discovered that it has random behavior when there is more than about 4000 events. Basically my code is : #read the results into a variable (results, dummyresults, settings) = si.getOrganizedResults() for i in range(len(results)): statistics_fct(i, len) #return the results back to Splunk si.outputResults(results) My issue is that len(results) is wrong: When I call my custom command : xxxx | head 4000 | custom_command I have 4000 event displayed as expected. But the len(results) is 3779 and I see my index 'i' moving from 0 to 3779. Then after the 3779 first events, len(results) is 221 and my index i is reseted to 0 and goes from 0 to 221. Well as a result, all my calculation is wrong because I am performing statistic with sliding window and this calculation is base on index and len(Results). Do you know how to retrieve the correct len of the "results" to be able to walk through the results. Thanks for any help Regards ... View more