We have a 3rd party pulling AWS logs as far back as AWS holds onto logs. However, we want to be able to go back further so we are looking at our AWS index in Splunk. We want to extract a full export of _raw for the entire index. We have access to the management port of our searchhead which is pointing to an indexer cluster with all of the aws index data - noting that the index is SmartStore enabled. What's the best way to export this programmatically? It would not scale to manually run the search in the GUI and export it. We've looked at the oneshot search with js but it seems to be timing out even though we have baked in pagination. Thanks in advance ... View more

Hello, unfortunately I am having to attempt to do a restore of copies of old db_* and rb_* structures that were basically rsync'd over time to some cold storage. I am noticing that things like ".bucketManifest" don't exist. I am trying to restore it to  a net new indexer cluster with the index configured in indexes.conf. I am happy to do this on a standalone indexer if that's the right way to do this, assuming that this is even possible.   To be clear, i have all of the directories that are prefixed with rb_* and db_*, but nothing else. *EDIT* I actually only have db_*/rawdata/journal.gz and rb_*/rawdata/journal.gz Thanks ... View more

This is the URL it gives me: https://heavyforwarder.domain.com:8000/en-US/manager/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup?action=edit Takes me to 404 page: "https://heavyforwarder.domain.com:8000/en-US/manager/Splunk_TA_snow/apps/local/Splunk_TA_snow/setup" I pushed the app from my deployment server to the heavy forwarder. ... View more

When I enable/disable the input it pulls in new events, but it throws the below errors. If I leave it enabled and it stops pulling in logs after the first attempt. ERROR: /splunk/etc/apps/sft-audit-events-splunk/bin/app/node_modules/async/dist/async.js:473:16 /splunk/etc/apps/sft-audit-events-splunk/bin/app/sft-audit-events.js:215:72 /splunk/etc/apps/sft-audit-events-splunk/bin/sft-audit-events.sh" Logger.info(INPUT_NAME, "Got events: " + results.getAndEmitEvents.list.length "Dependencies This modular input depends on a couple of npm modules: 1. request - Apache 2.0 2. async - MIT 3. splunk-sdk - Apache 2.0 4. parse-link-header - MIT" https://splunkbase.splunk.com/app/3260/#/details ... View more