Hi  I am trying to upgrade my SPLUNK environment from 7.x to 8.1.9 I want to make sure if my universal fowarder which is 6.5.3 is compatibile with 8.1.9   Thanks Suresh ... View more

Hello Splunkers What is the recommended SPLUNK versions to upgrade for the below enterprise versions 7.0.0 7.3.0 7.1.2 Thanks Suresh ... View more

Like SPLUNK Mint available for Mobile Apps, is there any similar app available for collecting metrics from browser applications. ... View more

Does anyone know if "xMatters Actionable Alerts for Splunk" app is supported in the Search Clustered environment I tried with standalone search head, it works fine. I am able to get the alert through xMatters. I am having hard time getting it work through search deploy server -> search head cluster. The app requires URL and Passwords to be set up. Not sure how to supply through Search Deployer. ... View more

Hi I am trying to push the data from Splunk to a database. I have installed SPLUNK DB Connect in a Search Cluster and configured connection and output (datalab). The data is not getting inserted to DB. I am observing the below errors in _internal logs. 2019-07-03 19:22:03.702 +0000 [dw-254 - PUT /api/outputs/ASDA_APAOOS_DAILY_Report] WARN c.s.dbx.server.dboutput.task.DbOutputTaskLoader - failed to read output ASDA_APAOOS_DAILY_Report com.splunk.dbx.exception.ConfReadException: Error(s) occur when reading ASDA_APAOOS_DAILY_Report. 2019-07-03 19:22:03.702 +0000 [dw-254 - PUT /api/outputs/ASDA_APAOOS_DAILY_Report] ERROR c.s.d.m.repository.DefaultConfigurationRepository - action=failed_to_get_the_conf reason=HTTP 401 -- call not properly authenticated Has anyone faced this problem before? Please provide your suggestions for resolving this issue. ... View more

Query: index=summary_estore_error_cust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" | join USERID [search index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h ] | stats values(USERID) as UserId by eventTime When running the above query, I am getting this message under job section. [subsearch]: Subsearch produced 50000 results, truncating to maxout 50000. I have done the required changes in limits.conf and push it to all peers using Cluster Master [subsearch] maxout [join] subsearch_maxout still I am seeing the message "[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000." in search head. Could you please advise if I am missing any config here ... View more

Hi This is my current Splunk search: index=pqaestore source="/log/jboss_jmx_stats.log" | dedup host | rex field=_raw "(?memory=(?\d+))" | rex field=_raw "(?httpthreads=(?\d+))" | rex field=_raw "(?httpsthreads=(?\d+))" | rex field=_raw "(?websessions=(?\d+))" | rex field=_raw "(?ATGAdminDS=(?\d+))" | rex field=_raw "(?ATGCatalogDSA=(?\d+))" | rex field=_raw "(?ATGCatalogDSB=(?\d+))" | rex field=_raw "(?ATGCSCAdminDS=(?\d+))" | rex field=_raw "(?ATGCustDS=(?\d+))" | rex field=_raw "(?ATGOrderDS=(?\d+))" | rex field=_raw "(?ATGPriceDS=(?\d+))" | rex field=_raw "(?ATGSearchDS=(?\d+))" | rex field=_raw "(?DefaultDS=(?\d+))" | rex field=_raw "(?EStoreAdmDS=(?\d+))" | streamstats count as SNo| table SNo host FreeMemory httpthreads httpsthreads websessions ATGAdminDS ATGCatalogDSA ATGCatalogDSB ATGCSCAdminDS ATGCustDS ATGOrderDS ATGPriceDS ATGSearchDS DefaultDS EStoreAdmDS Table output [Removed the host from output as it is sensitive] FreeMemory httpthreads httpsthreads websessions ATGAdminDS ATGCatalogDSA 54 0 0 11 2 2 2 0 5 7 0 0 40 0 0 12 2 2 2 2 5 7 2 0 51 0 0 11 2 2 2 0 5 7 0 0 51 0 0 10 2 2 2 0 5 7 0 0 56 1 0 12 2 2 2 0 5 7 0 0 55 1 0 11 2 2 2 0 5 7 0 0 78 0 0 8 2 2 2 0 5 7 0 0 70 0 0 9 2 2 2 0 5 7 0 0 65 0 0 11 2 2 2 0 5 7 2 0 50 1 0 10 2 2 2 0 5 7 0 0 60 1 0 9 2 2 2 0 5 7 0 0 52 0 0 10 2 2 2 0 5 7 0 0 How to print Total, min, Max, Average at the end of this table as separate rows. Please advise. ... View more