Ive also installed the app, added the elasticsearch connection details but no data is being pulled back into the index ive set. 2021-04-08 14:30:31,055 DEBUG pid=19271 tid=MainThread file=base.py:log_request_success:259 | < {"succeeded":true,"num_freed":45} I see requests are successful but I cant find any other log to suggest why data is not being indexed in splunk. Any advice on where i can look next? ... View more

Not sure if this was ever solved, but if you remove the app from $SPLUNK_HOME/etc/app/your_app and under any user directories, and remove $SPLUNK_HOME/etc/app/splunk_app_addon-builder, then reinstall the splunk app add-on builder and restart splunk, you should be able to re-import your app no problem. I'm not sure what remnants get left behind in one of the app add-on builder files, but this worked for me. ... View more

I downvoted this post because ugh, it went to negative one, not zero ... View more

The problem right now is that there is NO SPL file in the git hub repository. https://github.com/microsoft/AzureMonitorAddonForSplunk/tree/master/packages The app should install to TA_Azure_Monitor, but without the package, the GIT can be downloaded as a Zip ... View more

Hi, As I understand it's better that the Checkpoint value be numeric. But first of all, using Rising Column ("abc " in your case) could you leave "Checkpoint Value" field empty ? This will tell DBConnect to load all the records during the first request. If that worked then the issue was the value within the checkpoint in the first place. Thank you! ... View more

This might be helpful for anyone visiting; I have started working on an addon for Azure Event Hubs for Splunk, feel free to use it! https://splunkbase.splunk.com/app/4343/ regards, ... View more

This might be helpful for anyone visiting; I have started working on an addon for Elasticsearch instances, feel free to use it! https://splunkbase.splunk.com/app/4175/ ... View more

That worked fine! Thank you! ... View more

This might be helpful for anyone visiting; I have started working on an addon for Elasticsearch instances, feel free to use it! https://splunkbase.splunk.com/app/4175/ ... View more

This might be helpful for anyone visiting; I have started working on an addon for Azure Event Hubs for Splunk, feel free to use it! https://splunkbase.splunk.com/app/4343/ regards, ... View more

Hi p_gurav! Could you please share your experience, are these 2 solutions reliable as an instument for data input? Like splunk dbconnect, for example. Thanks in advance. Rashid ... View more

You can't. The alternative is to migrate the data from elastic to splunk. https://splunkbase.splunk.com/app/4175/ ... View more

Thank you for your answer! I'll try this approach. ... View more

same here please 🙂 ... View more

Given that R80 supports syslog forwarding, you might want to take a look a that. Could make your checkpoint data collection a lot easier. You'd need to create a custom TA for it, since the official add-on does not support the syslog format, but apart from the basic field extractions, you can re-use a lot of logic from the original TA. ... View more

Somesoni's regex should work, the problem was your data sample, all the records ended with "OK+A" but it looks like not after all. So, you have to change/remove \+A\s+ after the OK from the regular expresion. ... View more

This might be helpful for anyone visiting; I have started working on an addon for Elasticsearch instances, feel free to use it! https://splunkbase.splunk.com/app/4175/ ... View more