Hi All, We are planning to upgrade Splunk from 6.4.3 to 6.5.2 before we upgrade to 7.2 or 7.3. I can see the installation uses the symbolic link to the Splunk version, in our case it's Splunk 6.4.3 linked to rel rel -> splunk-6.4.3 $SPLUNK_HOME is set to /app/splunk/rel, I believe I need to unlink the symbolic link before the upgrade and run the below command in /app and NOT in /app/splunk folder. Just not sure about this. Hopefully someone can shed some light here, please. tar -xzf splunk-6.5.2-67571ef4b87d-Linux-x86_64.tgz -C /app Please do let me know if this approach would work. Any help is much appreciated. ... View more

Hi all, I am working on a piece of work on reconciling the trades from DB and a log. I had a thought that the below query should be working fine, but it is not. It has shown be 9K differences if I ran it against Today or yesterday time range. I have checked the query separately to see if the version has changed, but it's the same version and same trade when I ran the 2 searches separately. | set diff [search index=stdb sourcetype=stdbtype | dedup TRADEID sortby -AUD_VER | rename TRADEID as tradeId,AUD_VER as SMTVersion | table tradeId, SMTVersion] [search index=XXX_inbound SMT55/BOND_TR | dedup tradeId sortby -SMTVersion | table tradeId, SMTVersion] If I investigate a few trades, the version and the trade ID are the same, but it shows as a difference in the above query. I'm not sure why and I'm pretty much confused. Any help is much appreciated. ... View more

Hi All, I would like to know about the quota being used by the dashboard. If a dashboard is opened by user X, will the query use up user X's quota or does it use up the person (owner) who had set it up? For example: if it's a saved search that is being used in the dashboard, will the owner's search quota be used up every time any one opens that dashboard? Or is it the user who has recently opened the dashboard? This is a bit confusing for me as a newbie, and I haven't found any references about the quota for the dashboard. Any help or references would help! ... View more

Hi All, I'm a newbie to the Splunk world! I'm monitoring a path which point to a JSON file, the inputs.conf has been setup to monitor the file path as shown below and im using the source type as _json [monitor://<windows path to the file>\*.json] disabled = false index = index_name sourcetype = _json below is the error im getting in the Internal splunk logs, 11-12-2018 23:04:02.745 +0000 ERROR JsonLineBreaker - JSON StreamId:11440680656958819810 had parsing error:Unexpected character while looking for value: ']' - data_source="<path of windows monitoring\>cucumber.json", data_host="<hostname>", data_sourcetype="_json" Is there a way this issue could be resolved, sometimes the data is getting indexed but sometimes they are not available. I could see in the splunk logs that it has error'ed as shown above on most of the days. Not sure if its working as expected. I believe someone could help me out on this Sample JSON added, [ { "line": 1, "elements": [ { "before": [ { "result": { "duration": 3007379010, "status": "passed" }, "match": { "location": "Hook.InitializeTest()" } } ], "line": 3, "name": "Verify the health of XXXXXX Application", "description": "", "id": "XXXXXX-application;verify-the-health-of-XXXXXX-application", "after": [ { "result": { "duration": 1506065506, "status": "passed" }, "match": { "location": "Hook.TearDownTest(Scenario)" } } ], "type": "scenario", "keyword": "Scenario", "steps": [ { "result": { "duration": 1499020197, "status": "passed" }, "line": 4, "name": "launch the XXXXXX application URL", "match": { "location": "XXXXXXStep.user_launches_the_XXXXXX_application_URL()" }, "keyword": "When " }, { "result": { "duration": 47893377, "status": "passed" }, "line": 5, "name": "the XXXXXX application launched successfully", "match": { "location": "XXXXXXStep.the_XXXXXX_application_launched_successfully()" }, "keyword": "Then " }, { "result": { "duration": 3762996694, "status": "passed" }, "line": 6, "name": "login into XXXXXX application", "match": { "location": "XXXXXXStep.login_into_XXXXXX_application()" }, "keyword": "When " }, { "result": { "duration": 279313222, "status": "passed" }, "line": 7, "name": "verify page title displayed as \"XXXXXX Dashboard\"", "match": { "arguments": [ { "val": "XXXXXX Dashboard", "offset": 32 } ], "location": "GenericStep.verify_page_title_displayed_as(String)" }, "keyword": "Then " }, { "result": { "duration": 18273214543, "status": "passed" }, "line": 8, "name": "Create XXXXXX with \"default checkbox\" checked", "match": { "arguments": [ { "val": "default checkbox", "offset": 20 } ], "location": "XXXXXXStep.Create_XXXXXX_with_checked(String)" }, "keyword": "When " }, { "result": { "duration": 336633357, "status": "passed" }, "line": 9, "name": "verify XXXXXX is displayed successfully with name \"Client Rate\"", "match": { "arguments": [ { "val": "Client Rate", "offset": 51 } ], "location": "XXXXXXStep.verify_XXXXXX_is_displayed_successfully(String)" }, "keyword": "Then " }, { "result": { "duration": 18389039668, "status": "passed" }, "line": 10, "name": "Create XXXXXX with \"clean growth\" checked", "match": { "arguments": [ { "val": "clean growth", "offset": 20 } ], "location": "XXXXXXStep.Create_XXXXXX_with_checked(String)" }, "keyword": "When " }, { "result": { "duration": 327113991, "status": "passed" }, "embeddings": [ { "data": "some very big data here", "mime_type": "image/png" } ], "line": 7, "name": "Health of EUR Forwards is ok", "match": { "location": "YYYYYYYStep.health_of_EUR_Forwards_is_ok()" }, "keyword": "Then " } ], "tags": [ { "line": 2, "name": "@Ready2" } ] } ], "name": "YYYYYYY Application EUR Fwds Check", "description": "", "id": "YYYYYYY-application-eur-fwds-check", "keyword": "Feature", "uri": "YYYYYYYEURFwdsCheck.feature" } ] ... View more