I'm thinking there may be some firewall rules between my HF running DBX and the database. That said, the Netezza driver has given others some trouble as well and I don't know that we'll get around that. I'm going to hunt down the firewall issues and see if that doesn't aid connectivity. That said, I was able to get the driver loaded, which answered the question, so I'm marking this solution as accepted. ... View more

[splunk@host drivers]$ ll total 2332 -rw-r--r-- 1 splunk splunk 317816 Oct 17 10:48 jtds-1.3.1.jar -rw-r--r-- 1 splunk splunk 999635 Aug 28 22:13 mysql-connector-java-5.1.44-bin.jar -rw-r--r-- 1 splunk splunk 340338 Nov 20 14:29 nzjdbc3.jar -rw-r--r-- 1 splunk splunk 713037 Oct 17 10:55 postgresql-42.1.4.jar -rw-r--r-- 1 splunk splunk 41 Oct 17 10:05 README And... [splunk@host local]$ ll total 28 -rw------- 1 splunk splunk 28 Oct 17 10:05 app.conf -rw------- 1 splunk splunk 229 Nov 27 08:45 db_connections.conf -rw-rw-r-- 1 splunk splunk 185 Nov 27 08:39 db_connection_types.conf -rw------- 1 splunk splunk 44 Oct 17 10:13 dbx_settings.conf -rw------- 1 splunk splunk 267 Nov 20 14:25 identities.conf -rw------- 1 splunk splunk 89 Oct 17 10:13 inputs.conf -rw------- 1 splunk splunk 69 Oct 17 10:05 ui-metrics-collector.conf Permissions seem to be good to go. Splunk processes are running as the splunk user, so there shouldn't be any issues there. ... View more

Just updated the original post. Splunk Answers really should allow uploading of images... ... View more

I have. Once I added that config to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/db_connection_types.conf , I restarted and attempted to create the connection. The screenshot below shows the error it threw: ... View more

The answer most likely has to do with the fact that the Bro Add-On uses the INDEXED_EXTRACTONS setting to index the events as events with headers. What this does is index each of those fields and thus the index is HUGE. I recently discovered that Bro can log in JSON format and am working to port the Add-On over to use KV_MODE = JSON instead of INDEXED_EXTRACTIONS . The difficulty is that I'll have to use a different index to store the new format in and potentially use a different sourcetype bro_json_http versus bro_http since the field extractions are based on props.conf settings. Hope this helps. ... View more

Not sure if this is more in line with what you're looking for, but this latest Splunk blog entry shows a slick way of adding tabs to a panel: http://blogs.splunk.com/2015/03/30/making-a-dashboard-with-tabs-and-searches-that-run-when-clicked/ ... View more

Thanks, I'll give that a try and report back. ... View more

Correct. However, when I perform a data model search | datamodel ... from another app, with Splice enabled, I get the error_code=255 . When I disable it, I'm able to perform the searches. It appears that Splice is getting in the way. ... View more

Thanks. I have Alert Manager; though it's in a testing phase right now. We'll look at that for a more permanent solution. Thanks again. Josh ... View more

Splunk service is being restart in order to read in new configs and install new apps. It doesn't seem smart that the alerts are stored on disk (kv store, summary index, etc.) ... View more

Did you ever figure this one out? We're using REST to populate a dashboard with fired alerts and noticed the same behavior. ... View more

@jrodriguezap: I have the exact same spam solution that you have and I have run into the exact same issue you've been dealing with. I haven't tried the summary index trick, though I admit I had thought of it. I'd hate to waste the storage space just to get the events from this log source into a single event, so I was hoping you may have figured out a way to do this. Any luck on this front? ... View more

I'll check for that. Not sure I do, but I'll check. To be honest, I'm seeing stanza matches for Windows event logs when I search for Bro events or anything else. It's like Splunk loads every single props/transforms stanza for field extraction on every search regardless of the search criteria. ... View more

I've read the mode documentation and I agree, fast mode is just as it's named: faster. However, when running inline searches for dashboard panels, searches often take a long time. Also, the root question about whether or not Splunk should attempt to extract fields based on field extraction stanzas that do not match the search terms remains to be answered. For example, if my search is: sourcetype=foo earliest=-60m@m shouldn't Splunk only load the field extractions that match that source, sourcetype, or host? Currently, whenever I search for anything, Splunk loads the field extractions for everything under the sun. I believe this is leading to longer search times. ... View more

index=_internal fwdType="*" | dedup hostname | stats count by os, version ... View more

Thanks for the write-up. I'll see how our environment is set up and go from there. ... View more

Thanks. We decided to modify the output of the Security Center reports to match that required by the Nessus in Splunk app. ... View more

So, I ran the search manually with the lookup and I was able to match fields in the search with fields in the lookup, but the OUTPUT field was not...output. No dice. But, thanks. ... View more