Hi, Splunk is not able to send alert/mail. We are getting below error message. 08-02-2016 04:49:05.799 -0500 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https:10.126.33.22@go?sid=scheduler_cms_Q0NNUy1UQS1vbnByZW0tcGxhdGZvcm0tcmVwb3J0aW5nRMD5e748673ac079e532_at_1470131340_24_577E0027-6C88-4096-88B0-9AF1F73327F8" "ssname=Splunk_D_SLM_IR_SHR" "graceful=True" "trigger_time=1470131342" results_file="/opt/splunk/var/run/splunk/dispatch/schedulercms_Q0NNUy1UQS1vbnByZW0tcGxhdGZvcm0tcmVwb3J0aW5n_RMD5e748673ac079e532_at_1470131340_24_577E0027-6C88-4096-88B0-9AF1F73327F8/results.csv.gz"': ERROR:root:Connection unexpectedly closed while sending mail to: splunk@localhost.localdomain Can somebody please help here? Thanks, Jitendra ... View more

Hi, I upgraded Splunk from 6.3.0 to 6.4.1. On restarting Splunk, I am getting below messages. Checking filesystem compatibility... Done *Checking conf files for problems... Invalid value in stanza [header_nullq] in /opt/splunk/etc/apps/CCMS-TA-onprem-reporting/default/transforms.conf, line 4: (key: DEST_KEY, value: nullqueue) * Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' cannot find non-empty stack=download-trial for pool=auto_generated_pool_download-trial, skipping Done // Content of my transforms.conf file [header_nullq] DEST_KEY = queue REGEX = ^TimeStamp FORMAT = nullqueue Is it due to the upgrade? How to resolve this issue? Can somebody please help here? Thanks, Jitendra ... View more

We are migrating from Splunk 6.3.0 to Splunk 6.4.1. Any configuration changes need to be made? Or all the apps will work properly without any changes? ... View more

Hi, We are upgrading all of our Splunk components from Splunk 6.3.0 to 6.4.1. Following are the servers in the clustered environment. a) License server b) Deployment server c) Cluster Master d) Search Head Cluster Deployer e) Search Heads f) Indexers g) Forwarders What is recommended order to upgrade the above servers? Thanks, Jitendra ... View more

Hi, I want to execute a saved search from a Python script. Can somebody please tell me how to proceed with it? We have the Splunk Python SDK. We can only list the saved searches, not run them. Thanks, Jitendra ... View more

Hi, We tried generating the search report and email it as a PDF, but the report name is getting truncated. Example: Search name:SplunkReport_hourly_splunkoffer_incident management report_monthly service review This was our search name. This report will be emailed as PDF, but it's coming in with the name below: splunkreport_hourly_splunkoffer_incident_managemen-2016-02-09.pdf We want the same search name for our pdf. Please help us here. Thanks, Jitendra ... View more

Hi, I am able to send email (with pdf attachment) from the Splunk to my mail server. PDF attached has got a name with date. How can I have a PDF with both date and timestamp? Any changes need to be done in sendEmail.py? It would be great if somebody could help me here. Thanks, Jitendra ... View more