hi  Any further update on this issue? I also present the same ... View more

Btw, the Time Picker works in Splunk Mobile App if the old tags are used. For example, the fieldset tag works when earliestTime and latestTime tags are used. However, even if you set the default value of the token in the dashoard Splunk Mobile App internally defaults to "All Time". That's why when you first open the dashboard it will run an All Time query. You can cancel the query by picking a new time from the time picker. This can be a performance hog the search head especially if there a lot of Splunk Mobile App users in your Enterprise installation. The quick and dirty workaround is to create dashboards with hardcoded time-range and just label the dashboard accordingly, i.e. Chart (Today), Chart (Yesterday), etc. ... View more

I have just configured this on DB Connect v1.2.2 using a thin connection string with an address list containing two hosts and it works for me. First I had to create a new database type in $SPLUNK_HOME/etc/apps/dbx/local/database_types.conf and hard code the hostnames of the multiple hosts. The only dynamic parts in the connection string are the service name (SID) and port: #Bits in bold can/need to be changed to reflect your environment [oracle-service-x] displayName = OracleServiceX defaultCatalogName = ORCLX jdbcDriverClass = oracle.jdbc.OracleDriver connectionUrlFormat = jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST=(LOAD_BALANCE=off)(ADDRESS=(PROTOCOL=TCP)(HOST=host1)(PORT={1}))(ADDRESS=(PROTOCOL=TCP)(HOST=host2)(PORT={1})))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME={2}))) testQuery = SELECT 1 FROM DUAL defaultPort = 1521 Then I added a new connection by editing the configuration file $SPLUNK_HOME/etc/apps/dbx/local/database.conf: [ConnectionXYZ] database = SIDNAME database.sid = true host = ANYTHING isolation_level = DATABASE_SETTING password = ANYTHING port = 1521 readonly = 1 type = oracle-service-x username = ORACLEUSERNAME Then restart splunk. Using the web interface login, navigate to the newly created connection and set the password. Then all should be working. The trick to this that kept catching me out was the default configuration in $SPLUNK_HOME/etc/apps/dbx/local/database_types.conf for oracle had the line typeClass = com.splunk.dbx.sql.type.impl.Oracle and if this line exists the connectionUrlFormat line is ignored. So by simply removing this typeClass configuration the connection string is used and presumably you can use any normal oracle connection parameters. I hope this helps anyone trying to set this up. ... View more

thanks for the tip! ... View more

I encountered the same error ( Encountered the following error while trying to save: In handler 'streamfwd': The script returned with exit status 2.) when trying to edit the modular input streamfwd (more settings) to set it to another index. splunkd showed this: 08-18-2015 23:57:46.463 -0700 ERROR ModularInputs - Argument validation for scheme=streamfwd: killing process, because executing it took too long (over 30000 msecs). 08-18-2015 23:57:46.465 -0700 INFO ModularInputs - Argument validation for scheme=streamfwd: script running failed (killed by signal 9: Killed: 9). I initially untarred the splunk_app_stream.tar file and copied it into etc/apps/ and restarted splunk for the first install which led me to the error. To fix the issue I removed the Splunk_TA_stream and the splunk_app_stream , restarted splunk then installed from the web UI under Apps>Find More Apps . I then enabled the modular input through the web UI (Settings>Data Inputs> Wire Data > streamfwd - enable. To see http data I went to the Splunk App for Stream from the app menu and enabled the http protocol. Then did a search for index=* source=stream* and see data now. My system was a standalone server so fwdr/SH/IDX all in one. ... View more