Hi all, I am currently working on creating an alert to notify if the status of a switch is disable for more than 10 min, common scenario is that switches disconnect for a min and would be back to running, we would only like to target the ones whose status remains disconnected for more than 10 min. Below is the sample log: Apr 18 07:46:25 hostname tag=abc CEF:0Agent status changed|Status of agent "name" at IP "ip address" (id=10,0) changed from running to disabled Apr 11 07:50:10 hostname tag=abc CEF:0Agent status changed|Status of agent "name" at IP "ip address" (id=10,0) changed from disabled to Running ... View more

HI All, Have installed rest app for Splunk and tried configuring logs from an rest API, all the sources are working fine but we stopped receiving logs while accessing an API, i see below error. 0600 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: HTTPSConnectionPool(host='hostname', port=port number): Max retries exceeded with url: URL (Caused by : [Errno 104] Connection reset by peer) ... View more

HI All, I have configured the Splunk Rest API Modular input to pull logs from an elastic end point. I also configured a python script in responsehandler.py to modify the logs we are receiving. We were receiving logs fine for a few days. But recently, we stopped receiving logs abruptly and then we received the below error. I'm not sure what the issue is. Restart is fixing the issue temporarily, but the same error is popping and would stop receiving logs. ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: HTTPSConnectionPool(host=’endpoint.com’, port=443): Max retries exceeded with url: /api/query/v1/logs?limit=9999 (Caused by : [Errno 104] Connection reset by peer) ... View more

We have many applications currently logging to CAL by default, we are interested in collecting these logs to Splunk. I am not sure if we have any mechanism currently to collect these logs to Splunk, please suggest if any. ... View more