Thanks, You are right!  Need to use back quotes ... View more

I changed to  ....| eval log_info=_raw | "securemsg(log_info)" | ..., but got the same error how to use  <ctrl><shift>E to expand the macro? Thanks ... View more

Thanks again. Then How can I clone the alert action to Splunk App for Infrastructure? ... View more

Thanks! How can  I "close the alert action into the desired app"  ?   ... View more

yes, it is Global ... View more

I checked with Manage Apps, and confirmed that Splunk App for Remedy has Global sharing permission. ... View more

I installed Splunk App for Remedy, but I cannot see Splunk App for Remedy as an alert option for Splunk App for Infrastructure.   ... View more

I have Splunk App for Infrastructure installed, currently we can create an alert for Splunk App for Infrastructure using one of following default alert  methods: email, VictorOps, Slack and  Custom Web-hook.  instead of using these default methods, we want to know if we can use Splunk App for Remedy as alert action to create ticket to Remedy?  Thanks ... View more

does it support Enterprise 8.0.0? ... View more

is there any update on this? we have the same issue. is it updated with 8.0.0 release? Thanks ... View more

McAfee complains cannot find tem files like: ERROR OASManager [6611] skipping since file path /tmp/rERp5c could not be opened due to - No such file or directory. I am not sure who created these tmp files like rERp5c, we have Splunk Enterprise and Splunk App for Infrastructure installed with this linux server. is there any way we can capture who is writing temporary files to /tmp folder? ... View more

any update on this issue? ... View more

Thanks, I have processes plugin configured, and process "crond" is monitored, I can find crond process is listed in the Metrics. but how can I monitor this process is up and run? use ps_code, ps_rss...? Thanks again. ... View more

Thanks, this fixed the issue! Thanks again! ... View more

Here is the curl command result: {"text":"Server is busy","code":9,"invalid-event-number":0} ... View more

I didn't see any indexing error like " metric event not indexed". But do see following Parsing error: 01-07-2019 17:18:04.592 -0500 ERROR HttpInputDataHandler - Parsing error : Server is busy ... View more

I didn't see any indexing error like " metric event not indexed"., but I do see parsing error: 01-07-2019 17:18:04.592 -0500 ERROR HttpInputDataHandler - Parsing error : Server is busy ... View more

my token looks like : "xxx2fb15-5c36-489e-b624-xyzgdshg", Not the name of token. Dimension "entity_type:Linux_Host" was comment out. ... View more

Check collectd again: 1. collectd service is running. Yes 2. No errors in collectd.log file No 3. Plugin write_splunk is there in collectd.conf file. server "ServerIpAddress" port "8088" token "tokenValve_Not_the name of the token" ssl true verifyssl false Dimension "entity_type:Linux_Host" The server (SAI server), token, port are correct for write_splunk in collectd.conf file Yes Check SAI again: Add-on for Infra installed Yes Token used by collectd is enabled and use em_metrics for sourcetype and index. Yes ... View more

Config file for collectd(1). Please read collectd.conf(5) for a list of options. http://collectd.org/ Global ---------------------------------------------------------------------------- Global settings for the daemon. Hostname "xxxxxxx" FQDNLookup false BaseDir "/var/lib/collectd" PIDFile "/var/run/collectd.pid" PluginDir "/usr/lib64/collectd" TypesDB "/usr/share/collectd/types.db" ---------------------------------------------------------------------------- When enabled, plugins are loaded automatically with the default options when an appropriate block is encountered. Disabled by default. ---------------------------------------------------------------------------- AutoLoadPlugin false ---------------------------------------------------------------------------- When enabled, internal statistics are collected, using "collectd" as the plugin name. Disabled by default. ---------------------------------------------------------------------------- CollectInternalStats false ---------------------------------------------------------------------------- Interval at which to query values. This may be overwritten on a per-plugin base by using the 'Interval' option of the LoadPlugin block: Interval 60 ---------------------------------------------------------------------------- Interval 60 MaxReadInterval 86400 Timeout 2 ReadThreads 5 WriteThreads 5 Limit the size of the write queue. Default is no limit. Setting up a limit is recommended for servers handling a high volume of traffic. WriteQueueLimitHigh 1000000 WriteQueueLimitLow 800000 Logging ---------------------------------------------------------------------------- Plugins which provide logging functions should be loaded first, so log messages generated when loading or configuring other plugins can be accessed. LoadPlugin syslog LoadPlugin logfile FlushInterval 30 LoadPlugin section ---------------------------------------------------------------------------- Lines beginning with a single `#' belong to plugins which have been built but are disabled by default. Lines beginning with `##' belong to plugins which have not been built due to missing dependencies or because they have been deactivated explicitly. LoadPlugin csv LoadPlugin cpu LoadPlugin memory LoadPlugin df LoadPlugin load LoadPlugin disk LoadPlugin interface Plugin configuration ---------------------------------------------------------------------------- In this section configuration stubs for each plugin are provided. A desc- ription of those options is available in the collectd.conf(5) manual page. LogLevel info LogLevel notice File "/etc/collectd/collectd.log" Timestamp true PrintSeverity true LogLevel info ReportByCpu true ReportByState true ValuesPercentage true ValuesAbsolute false ValuesPercentage true FSType "ext2" FSType "ext3" FSType "ext4" FSType "XFS" FSType "rootfs" FSType "overlay" FSType "hfs" ReportByDevice true ValuesAbsolute false ValuesPercentage true IgnoreSelected false ReportRelative true Disk "" IgnoreSelected true UdevNameAttr "DEVNAME" IgnoreSelected true Customization for Splunk ---------------------------------------------------------------------------- This plugin sends all metrics data from other plugins to Splunk via HEC. server "1111111111111111111" port "8088" token "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" ssl true verifyssl false Dimension "entity_type:Linux_Host" ... View more