I was wondering if it is possible to build a regex for a pipe separated file… Where the Header row carries the name of the field. Example – EmployeeID|FirstName|LastName|MiddleName|GivenName|EmployeeStatus|EmployeeType|Action|EffectiveDate|Hire_Date|TerminationDate|RehireDate|CO_ID|Paygroup|DISTRICT|OpsDistrict|Store|JobCode|Title|Department|Country|HiringManager_Emp_ID|Supervisor_Emp_ID|StoreMenuLevel|UserRegion|UserDistrict|EmployeeClass|HomeDeptName|ManagerLevelCode|LastModifiedDate||ExpBatchDate 013216|Corey|Forey|M||A|F|PAY|2012-07-01|1999-04-03|1900-01-01|1900-01-01|GCS|GC1|033|033|339|1071|Operations Manager|575000|NULL|32342|32342|9|2|033|OPS|Ops Managers|3|2012-07-17|2013-03-08 013243|Jose|Fose|M||A|F|PAY|2012-07-01|1999-04-05|1900-01-01|1900-01-01|GCS|GC1|015|015|226|1983|Sales Associate|415000|NULL|51184|51184|6|1|015|SLS|Asst Manager|6|2013-03-01|2013-03-08 It of course works fine if I convert the file to a csv file. So basically I want to use the csv source type but use “|” instead of comma… ... View more

Hi, I've configured the mail server with "no Security" But I get this error when an Alert is trying to send out an email... 2013-03-05 15:15:04,181 INFO sendemail:mail sendPDF = False, pdfview = , searchid = scheduler_adminsearchRMD5c7d8736e6fb7e30b_at_1362525300_145 2013-03-05 15:15:04,181 DEBUG Preloading from 'C:\Program Files\Splunk\var\run\splunk\merged\server.conf'. 2013-03-05 15:15:04,181 DEBUG Preloading from 'C:\Program Files\Splunk\var\run\splunk\merged\web.conf'. 2013-03-05 15:15:04,181 DEBUG simpleRequest > GET https://127.0.0.1:8089/servicesNS/nobody/search/admin/alert_actions/email [] sessionSource=direct 2013-03-05 15:15:04,615 DEBUG simpleRequest < server responded status=200 responseTime=0.4330s 2013-03-05 15:15:04,615 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduleradminsearchRMD5c7d8736e6fb7e30b_at_1362525300_145?message_level=warn [] sessionSource=direct 2013-03-05 15:15:04,625 DEBUG simpleRequest < server responded status=200 responseTime=0.0100s 2013-03-05 15:15:04,625 DEBUG getStatus - elapsed=0.00999999046326 nextRetry=0.050000008 2013-03-05 15:15:04,914 ERROR Sending email. subject="Splunk Alert: FIM Errors Daily", results_link="http://CVARTAK-E6510:8000/app/search/@go?sid=scheduleradminsearch_RMD5c7d8736e6fb7e30b_at_1362525300_145", recipients="['[email protected]']" 2013-03-05 15:15:04,914 ERROR No suitable authentication method found. while sending mail to: [email protected] ... View more

Hi, Could please help with this error. I'm trying to configure external DB (SQL Server) - Encountered the following error while trying to update: In handler 'dbx-databases': Unexpected error " " from python handler: "Command com.splunk.bridge.cmd.Reload returned status code 47". See splunkd.log for more details Details from splunkd.log - 02-18-2013 16:46:17.531 -0800 ERROR AdminManager - Stack trace from python handler:\nTraceback (most recent call last):\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 70, in init\n hand.execute(info)\n File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 489, in execute\n if self.requestedAction == ACTION_EDIT: self.handleEdit(confInfo)\n File "C:\Program Files\Splunk\etc\apps\dbx\bin\spp\config.py", line 215, in handleEdit\n self.postEditCallback()\n File "C:\Program Files\Splunk\etc\apps\dbx\bin\spp\config.py", line 218, in postEditCallback\n self.postModificationCallback()\n File "C:\Program Files\Splunk\etc\apps\dbx\bin\rest_handler_databases.py", line 55, in postModificationCallback\n executeBridgeCommand("com.splunk.bridge.cmd.Reload", args=["databases"], checkStatus=True)\n File "C:\Program Files\Splunk\etc\apps\dbx\bin\spp\java\bridge.py", line 170, in executeBridgeCommand\n raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\nJavaBridgeError: Command com.splunk.bridge.cmd.Reload returned status code 47\n 02-18-2013 16:46:17.531 -0800 ERROR AdminManager - Unexpected error " " from python handler: "Command com.splunk.bridge.cmd.Reload returned status code 47". See splunkd.log for more details. ... View more