Hi Splunker, I tried install Eventgen app version 6.5.2 on Splunk Enterprise 8.1.1 under Windows 10 for testing. However, came out the error message: Unable to initialize modular input "modinput_eventgen" defined in the app "SA-Eventgen": Introspecting scheme=modinput_eventgen: script running failed (exited with code 1).. Any idea to fix this issue? Thanks ... View more

Hi All Splunker, May I know how to set frozenTimePeriodInSecs under a different App? Example Compliance App retention period is 180 days for all index name, Audit App retention is 90 days for all index name, due to every time need create a lot of index name under those App, for convenient and fulfill the compliance retention needed, can we set frozenTimePeriodInSecs under App-level instead of System-level or one by one index name (avoid human mistake also)? I got try it under $SPLUNK_HOME/etc/app/compliance/local and $SPLUNK_HOME/etc/app/audit/local under each app configure indexes.conf by input [default] stanza and set the frozenTimePeriodInSecs field for 180 days and 90 days and disabled global setting under System/local/indexes.conf. However, seem like it was failed due to precedence order issue. 1. System local directory -- highest priority 2. App local directories 3. App default directories 4. System default directory -- lowest priority If the same level of App local directories the default always gets the smaller value which is 90 days. So any expert over here can provide some advice? ... View more

Hi all, Any Splunk features able auto detect current login user client time zone, maybe detect on operating system level. This is because in worldwide users some country practice daylight saving time (DST). Example: Beginning summer season in March, and some local time zone adjusts clocks forward one hour. However, our normal user on DST location still refers on Splunk pertained time zone and report still automatically convert times into the time zone whereby selected in user Splunk profile, which is caused incorrect analysis of the data further by decision making. Thanks ... View more