2014-10-06 13:26:37,617 Eastern Daylight Time ERROR pdfgen_endpoint:237 - Exception raised while trying to render "M 24 Hour Report Log" to PDF. Flowable <Table@0x03056948 8 rows x 11 cols(tallest row 574)>...(424.0 x 1768), tallest cell 574.0 points, too large on page 2 in frame 'normal'(456.0 x 636.0*) of template 'Later' Traceback (most recent call last): File "D:\Splunk\etc\system\bin\pdfgen_endpoint.py", line 233, in _render self._pdfRenderer.save() File "D:\Splunk\Python-2.7\Lib\site-packages\splunk\pdf\pdfrenderer.py", line 419, in save doc.build(self._story, onFirstPage=_footer, onLaterPages=_footer) File "D:\Splunk\Python-2.7\Lib\site-packages\reportlab\platypus\doctemplate.py", line 1129, in build BaseDocTemplate.build(self,flowables, canvasmaker=canvasmaker) File "D:\Splunk\Python-2.7\Lib\site-packages\reportlab\platypus\doctemplate.py", line 892, in build self.handle_flowable(flowables) File "D:\Splunk\Python-2.7\Lib\site-packages\reportlab\platypus\doctemplate.py", line 805, in handle_flowable raise LayoutError(ident) LayoutError: Flowable <Table@0x03056948 8 rows x 11 cols(tallest row 574)>...(424.0 x 1768), tallest cell 574.0 points, too large on page 2 in frame 'normal'(456.0 x 636.0*) of template 'Later' ... View more

Strange issue. Whenever I try to run a dbx query or try to view a db via Splunk DB Connect->Database Info I get an error claiming the DB is not enabled. However, when I view the External DB Connection via Splunk Web Admin console splunk things the connection is enabled. I tried restarting Splunk but issue remaings. Any thoughts? ... View more

We are having issues with the Java Bridge Server. We are running splunk 4.3.4 as a search head in a windows VM. The server got restarted and the Java Bridge Server has not been able to come up.The following is continuously written out to dbx.log: 2013-05-17 16:05:49.544 main:INFO:Splunkd - Initialized Splunkd REST service service=127.0.0.1:8089 sessionKey=83143deb1f384a402ea7a4d009c5c62e 2013-05-17 16:05:49.544 main:DEBUG:PersistentValueStoreFactory - Default type xstream 2013-05-17 16:05:49.544 main:DEBUG:PersistentValueStoreFactory - Adding type=jdbm class=com.splunk.persistence.impl.JdbmStore 2013-05-17 16:05:49.544 main:DEBUG:PersistentValueStoreFactory - Adding type=xstream class=com.splunk.persistence.impl.XStreamStore 2013-05-17 16:05:49.559 main:DEBUG:XStreamStore - Initialized XStreamStore at E:\Program Files\Splunk\var\lib\splunk\persistentstorage\dbx\global\state.xml 2013-05-17 16:05:49.653 main:DEBUG:XStreamStore - Loading state from XML file... jbridge.log has this error: 4:23:24.805 PM 2013-05-17 16:23:24,805 DEBUG Error waiting for process: Java process returned error code 1! Error: Initializing Splunk context... Environment: SplunkEnvironment{SPLUNK_HOME=E:\Program Files\Splunk,SPLUNK_DB=E:\Program Files\Splunk\var\lib\splunk} Configuring Log4j... [Fatal Error] :1:1: Premature end of file. ... View more

We have a process to identify, capture, and write high priority/urgent events to a csv file that gets overwritten every time the process executes. The contents may not change for days. However, splunk is indexing the whole file every time the process runs--even if the contents of the file haven't changed. The program that creates the csv file calls an external vendor SOAP web service. I could add a whole bunch of logic to the program to persist a timestamp and use it as a filter for new service responses; But we prefer to index data as received/logged. I'm not sure what CRC values splunk is using to determine how to read the file. The next step is to see if those values are available in a debug/log file. Has anybody ran into this and know of a solution? ie I don't rule out user error. I'm fairly new to Splunk. Any help would be appreciated. ... View more

Scratching my head on this one. I'm relatively new to Splunk and the DBConnect app. I have successfully created several saved searches and have been able to chart the results. However, when I try to display the results of a saved search in a simpleresultstable the Splunk Search Job inspector displays the following: This search has completed and has returned 10 results by scanning 0 events in 0.829 seconds. It is an instance of the saved search: RemedyDB Oldest Unresolved Tix. The following messages were returned by the search subsystem: DEBUG: The 'dbquery' command is implemented as an external script and may cause the search to be significantly slower. DEBUG: search context: user="admin", app="mcitservicedesk", bs-pathname="D:\Splunk\etc" I'm using advanced XML as follows: <module name="HiddenSavedSearch" layoutPanel="panel_row4_col2" group="Oldest Unsolved Tickets" autoRun="True">   <param name="savedSearch">Oldest Unresolved Tix</param>   <module name="SimpleResultsTable">     <param name="drilldown">none</param>     <param name="entityName">events</param>     <param name="allowTransformedFieldSelect">True</param>   </module> </module> Saved Search looks like:   | dbquery database "SELECT ID, SUBMITTEDBY, CREATEDATE, RESOLVEDDATE, STAFFASSIGNED, MODIFIEDDATE, STATUS, UNIQNAME, GROUPX, CATEGORY, CLASS, ITEM FROM table name WHERE RESOLVEDDATE IS NULL AND INCIDENTX='TKT' AND ROWNUM < =10 ORDER   BY CREATEDATE" limit=10 | eval _time=CREATEDATE | sort+ CREATEDATE Any help would be greatly appreciated. ... View more

We have a need to use the vertical bar (ie "|") as a delimiter. Splunk DB Connect uses a comma. I tried searching for a config parameter but was unsuccessful. ... View more