What did it say in the migration log under ..\var\log\splunk? It will give more info about the errors, hopefully. ... View more

In addition to this: <fieldset autorun="false" submitButton="true"> Make sure if you have input fields that you have the searchWhenChanged="false" tag set on each of them: <input type="dropdown" token="source_ip" searchWhenChanged="false"> ... View more

Had same issue. This worked.... STEP 1: Commented out these two (2) lines in /opt/splunk/etc/apps/TA-websense/default/props.conf #REPORT-1category_id_for_websense = category_id_for_websense #FIELDALIAS-category_for_websense = category_id as category STEP 2: Added this local/props.conf file: /opt/splunk/etc/apps/TA-websense/local/props.conf [source::...websense] sourcetype = websense [websense] SEDCMD-setcatid = s/category=/category_id=/g LOOKUP-websense-categories-list = websense-categories-list WID AS category_id OUTPUTNEW Wcategory AS category (NOTE: The columns in my CSV were "WID" and "Wcategory") ... View more