I've set up some tables in DB Connect, using a timestamp (date_modified) as a rising column (there were no other suitable fields, and it's COTS, so the vendor isn't going to add a unique value).  The where column is "where date_modified > ?". The issue is that each time the input is run, it creates a new event for the most recent row.  I would expect that to happen is the where clause said "where date_modified >= ?", but with it set as "where date_modified > ?", I would think it would just add no rows. Has anyone else seen this? ... View more

I'm trying to get a large text file ingested using the HEC.  In my searches for the data, I see events that say "Message body length 3169085 greater than maximum allowed (2097152).  Where can I change that maximum?  I can't find any setting that says "Message body length", and I can't find any setting set to 2097152 ... View more

We have Splunk DB Connect 3.4.1 working with out SQL Server databases.  We also have an Oracle database that works over 1521 (non-ssl), but are trying to get it to work over SSL.  We've set up everything according to instructions bet we're getting this error message: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate) So it looks like there's a mismatch in cipher suites between DB Connect and the oracle database.  How can I find out which cipher suites DB Connect is trying to use?  we're using ojdbc8  for Oracle 19 ... View more

I'm trying to set up DB Connect to use Oracle Wallet.  I'm at step 5 under "Connect Splunk DB Connect to Oracle Wallet environments using ojdbc8"   (https://docs.splunk.com/Documentation/DBX/3.4.1/DeployDBX/Troubleshooting), where it asks me to prepend some text in JVM Options.  However, I have two JVM Options,  task server JVM Options and Query Server JVM Options.   Which one should I use?   BTW, I tried adding the text to both and it didn't work. ... View more

I heard that RHEL 7 can have mount points that point to S3...has anyone tried setting that up and placing index buckets on that partition?  Wondering if it's possible or not. ... View more

I have a Splunk cluster of 1 Search Head, 1 Index Master, and 2 Indexers in a cluster. I need to move all 4 to new hardware. What's the best way to do this? ... View more

One of my forwarders is not connecting with the indexers. Another system that is identical is connecting just fine. I keep getting errors about the message being rejected because it's too big, but I can't figure out where to adjust the allowed message size. This error is from the indexer: 03-04-2020 15:45:26.122 +0000 ERROR TcpInputProc - Message rejected. Received unexpected message of size=369295616 bytes from src=x.x.x.x:57186 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. ... View more

The disk usage is at 17% and inode usage is at 1%. The error message from Splunk Web says minFreeSpace is 5000 and free space is 85711: 03-03-2020 16:16:48.266 +0000 WARN DiskMon - MinFreeSpace=5000. The diskspace remaining=85711 is less than 2 x minFreeSpace ... View more

All the ones I ever see is Python. I need one that uses a bash script. ... View more

I have splunk getting data for the other objects, including Processor, but nothing happens for Process. The process stanza: [perfmon://Process] interval = 60 object = Process counters = _Total instances = * index = windows showZeroValue = 1 disabled = 0 The processor stanza: [perfmon://Proccesor] interval = 60 object = Processor counters = * instances = * index = windows showZeroValue = 1 ... View more

I have a splunk cluster (RHEL) with 2 indexers, and they seem to have a memory leak. Memory usage grows steadily until it runs out of memory and the OOM Killer kills the splunkd process. The only way to get the memory back is to restart the server (restarting splunk doesn't help). I've got two clusters that do this, and a few single instance splunk servers that never do this. Oddly enough, it's usually one of the indexers in the cluster that eats up memory first. ulimit and THP is set properly on all the servers. Has this happened to anyone? ... View more

I just installed a new UF on a Windows VM, and I'm getting an error that connection to the host failed, with "sock_error = 10054. SSL Error = No error" The indexers I'm trying to connect to can talk to a bunch of other Windows VMs. The ports to the indexers are open from the Windows VM that's having the problem. This configuration worked when I installed it on other VMs What does "SSL Error = No error" mean? ... View more