@raghavendrakb Do you by chance have a custom login_content in your web.conf file? If not, I would check all your conf files for multi-line entries and make sure that your multi-lines have a space in them. We just encountered a similar issue where we had a multi-line login banner and the last line was in column 1. Moving the last line to column 2 resolved this issue. ... View more

Could you clarify what you are trying to accomplish? You don't connect DB Connect to SSMS, you connect DB Connect directly to the SQL Server database engine. Which drivers you use depends on which version of Splunk, Java, DB Connect, and Microsoft SQL Server you are connecting to. ... View more

@vumanhtai , I don't know your network setup nor your application architecture so it is difficult to comment on why you have the HF setup to only check one node and why it can't check more than one node at a time. It sounds like you have some technical restrictions that would prevent you from using a single HF to check multiple nodes as well as the VIP. I would recommend working with your network and infrastructure team and explain what you are trying to do and if they have recommendations. You can install Splunk Enterprise as a HF on your individual server nodes and then install Website_Monitoring on each node and have the nodes check themselves via the localhost or server name. I still would not recommend this as this is a lot of additional overhead and complexity to manage. ... View more

@wwhite12 make sure you are using at least Website Monitoring 2.8; which was the first officially supported release for Splunk 8.x and Python 3. I would recommend updating to 2.9.1 or 2.9.2. As I mentioned to @jaimelopez, check the Health|Logs for ERRORs, what do you see? Then check your _internal logs for sourcetype=web_availability_modular_input OR sourcetype=website_monitoring_rest_handler for other errors or notes. ... View more

You can see the version of Website Monitoring by going to the app and looking at the "What's New" link. You also want to look at the Health|Logs and then filter to ERROR and see if there are any errors showing up. Your admin may need to search the _internal logs for other errors in sourcetype=web_availability_modular_input OR sourcetype=website_monitoring_rest_handler. ... View more

@jaimelopez We need a little more information to help out. Are you using website_input or website_monitoring? Which version do you have installed? Which version of Splunk are you using? ... View more

@vumanhtai, are you asking about running Website Monitoring on a device using the Unviersal Forwarder? I would not recommend doing and instead use a Heavy Forwarder. There are two reasons I caution against using a UF. Python is not installed with the Splunk UF by default and Website Monitoring relies on Python for its functionality. Resources needed for Website Monitoring can be high depending on how many sites you are planning on monitoring. You will want to have a server with enough CPU and RAM to support the number of connections and sites to be monitored. Is there a specific use case you are wanting to use the UF for instead of a HF? ... View more

I would try to test it on at least one test server and see if it resolves the problem. I don't see anything in the release notes about it fixing an issue with the monitor-nohandle but that doesn't necessarily mean anything. The quickest thing to do is to open a support case with the information and see if they are aware of the issue. It definitely sounds like a bug. ... View more

Good to know. Have you tried 8.0.0 of the Splunk Add-on for Microsoft Windows and seen if the issue persists there with the variable substitution? ... View more

You are welcome. Don't forget to mark my reply as the answer if it provided the help you needed. ... View more

Yes, you will need to restart Splunk on that instance. You may also need to clear your browser cache so it pulls down an updated file. ... View more

The exclude_from_alerts tag is defined in the tags.conf file as the eventtype filter_website_monitoring_alerts. You will find the search definition for this in eventtypes.conf. Right now the search is set to FILL_THIS_SEARCH_IN. Update the search definition to be what you would like either by adding the stanza to a local/eventtypes.conf or through the Settings|Event Types in the UI. You can also create additional eventtype definitions and associate those with the tag exclude_from_alerts as well. ... View more

Unfortunately, this is a hardcoded setting to 1000ms at this time and is not something that can be dynamically set as you found. You actually want the appserver/static/WebsiteStatusCellRenderer.js file. The section of code you are looking for is between lines 72 and 96. Adjust the else if statements to the times you are looking to have the 5 different percent values; 0, 25, 50, 75, 100. These percentages are used to drive two different aspects of the display. The first is the shape of the stopwatch icon that is displayed and how full it is. This is on line 100 in WebsiteStatusCellRenderer.js. The stopwatch font is then set in appserver/static/status_overview.css in lines 166 to 176. The second is the setting of the class of the table data (td.response_time.response-+percent) set on line 105 in WebsiteStatusCellRenderer.js. This td class is then used in appserver/static/status_overview.css in lines 115 to 143 to define the color of the cell. ... View more

@wwhite12 , which version of website monitoring and are you able to share your inputs.conf stanza and alert search (properly masked)? Also, what are the specs on your Heavy Forwarder and what else is running on it? ... View more

@sheamus69, which events are you seeing this field in? Are you using the Splunk Supporting Add-on for Active Directory to pull your account information in for analysis with ES? As you noted and per KB Article 555936; The Active Directory stores date/time values as the number of 100-nanosecond intervals that have elapsed since the 0 hour on January 1, 1601 till the date/time that is being stored. The time is always stored in Greenwich Mean Time (GMT) in the Active Directory. Using that information and the reference here, the formula would be =(((ROUNDDOWN(raw_date/10000000,0)/3600)+gmt_offset)/24)-109205 You should be able to put formula into an eval statement for Splunk. I asked about the Add-On for Active Directory because there is an easier method to retrieve this data by changing your ldapsearch to return the computed password expiry time in standard format. Here is a sample of what that would look like. | ldapsearch domain=contoso.com search="(&(objectClass=user)(!(objectClass=computer)))" attr="*;msDS-UserPasswordExpiryTimeComputed" | collect index=main sourcetype=activedirectory:json source=activedirectory_user host=ad1-contoso ... View more

@sramiz , you will actually want the Website Monitoring App installed on a Heavy Forwarder; as @richgalloway indicated, AND your searchhead. The app on the searchhead will provide the visualizations for the results coming out of your indexed data. You need to make sure that the permissions for Data Inputs is set so that noone is able to create a new web_ping input on your searchhead and you are managing those on your Heavy Forwarder. ... View more

@afx try creating a stanza named web_ping in local/inputs.conf and adding what you want for defaults there. [web_ping] index=mydefaultindex return_headers=true timeout=45 ... View more

@justindett, there is an option when you create an input for Website Monitoring that may help you with what you are trying to do. Use the 'Include Raw Output' checkbox under the Timeout field. This will capture the raw output from your check into a new event with the sourcetype of webping:response. You can then use a search to check the value of plans running against plans. index=website_monitoring sourcetype=webping:response source=webping://something 'plans running'<plans You can use the output from this search to create an alert. ... View more