you need to clean the kv store with this command below: splunk clean kvstore -app TA_MS_Teams -collection TA_MS_Teams_checkpointer   and restart splunk .   that should fix the issue.  ... View more

I am also having this same issue. In my case the file being read contains data coming in via syslog and written to disk. In the past I have deleted the files and restarted my Universal forwarder, which worked for a while, but eventually the logs would stop and I would see the crc errors in my splunk logs. ... View more

Thanks! The following option worked without having to combine any fields. |rex field=host "(?<hostname>[^\.]+)"   ... View more

Hi @nakiamatthews, Yeah just had a look and it's gone...doesn't mention anything in the release notes about it though.. Cheers, David ... View more

Creating a wrapper to call a Python installation on the host has been the conventional Splunk wisdom for years, as was bundling needed modules into the app. Both these approaches have numerous problems though. Using the wrapper is typically temperamental to permissions, environment variables, and in the case of the default system Python possibly versions of Python even older than 2.7. My suggestion is to check out a new app I've written called PyDen which allows you to create Python virtual environments and install PyPI packages to the environment. You can then use these environments to execute custom commands and scripted inputs. This provides three key advantages: You can pick the version of Python you'd like to write in, including 3.5 to 3.7 Create an isolated environment that won't interfere with imports in other apps (this can happen when packages are bundled into apps) Install any package available on PyPI to the environment ... View more