Hi, We have event with time field  Time=1650461136000 Props configuration parsing the time into  _time: 2022-04-20 16:25:36 _indextime: 04/20/2022 16:22:43 [props] TIME_PREFIX = ,\Time\= TIME_FORMAT = %s%3N That means the data ingest with future time. With that being said, what are we missing?  Why we still receive the warning   "WARN Date ParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (350) characters of event. Defaulting to timestamp of previous event" Thank you!   ... View more

Hi All, I'm running the query  | tstats count where index=<index name> by sourcetype No results   OR  | tstats values(sourcetype) where index=<index name> by index and the results for values(sourcetype) is null\empty. I have up to date data with  no delays in indextime . I've checked the fields.conf on indexers and I do see the field [sourcetype] **Also there are sourcetypes that does work and I see the field  Any ideas how to check this? or what can be the issue?   Thanks, Hen ... View more

  Hi  We get the error "500 Internal Server Error" on many pages of ES Splunk server  (Windows) Tried to change this on web.conf [settings] mgmtHostPort = XX.XX.XX.XXX:8089   Spoke with Splunk support they suggested to remove unnecessary apps and reduce the acceleration  time for DM. Still didn't help   Any Idea, what is the issue? Please assist.   Thanks, Hen ... View more

Hi All, I've ran a search and got these errors   I've checked the lookup and it's empty Is there a way to recover it? Thanks, Hen ... View more

Hello, I'm using DB connect 3.1.4, Here are the errors we get 2020-10-21 11:55:00.165 +0100 [QuartzScheduler_Worker-9] ERROR org.easybatch.core.job.BatchJob - Unable to write records java.io.IOException: HTTP Error 403, HEC response body: {"text":"Invalid token","code":4}, trace: HttpResponseProxy{HTTP/1.1 403 Forbidden [Date: Wed, 21 Oct 2020 10:55:00 GMT, Content-Type: application/json; charset=UTF-8, X-Content-Type-Options: nosniff, Content-Length: 33, Vary: Authorization, Connection: Keep-Alive, X-Frame-Options: SAMEORIGIN, Server: Splunkd] ResponseEntityProxy{[Content-Type: application/json; charset=UTF-8,Content-Length: 33,Chunked: false]}} at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:132) at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:96) at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36) at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203) at org.easybatch.core.job.BatchJob.call(BatchJob.java:79) at org.easybatch.extensions.quartz.Job.execute(Job.java:59) at org.quartz.core.JobRunShell.run(JobRunShell.java:202) at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573) 2020-10-21 11:55:00.165 +0100 [QuartzScheduler_Worker-9] INFO org.easybatch.core.job.BatchJob - Job 'XXXXXXXXXXXX' finished with status: FAILED   Execute SQL works, connection with DB is good The problem is that I don't see any new data coming in Already checked the Timstamp and tried to add  to db_inputs.conf token = [My_Token_Number]   Please assist. Thanks, Hen ... View more

Hello, I have logs from syslog server, my goal is to have events from the same log but these events will indexed with different sourcetype according to the IP in the log. lets say I have a row in the log with IP X his sourcetype will be ST1 for IP Y the sourcetype will be ST2 and so on. Here are my configurations inputs.conf [monitor://D:\Kiwi_DB] disabled = false index = db_it_syslog sourcetype = transformsourcetype props.conf [transformsourcetype] TRANSFORMS-transformsourcetype = change_st_by_IP1,change_st_by_IP2 transforms.conf [change_st_by_IP1] REGEX = "0.0.0.0" FORMAT = sourcetype::cyberark:epv:cef DEST_KEY = MetaData::Sourcetype Thanks! Hen ... View more

Hi All, I have 1 master cluster and 2 indexers . I've been using configuration bundle actions - push , several times. The last time I used this process I was trying to push an add-on the results on both of the indexers were: Added certificates , after that I edit the server.conf on both indexers with the correct URL and still didn't work. Any suggestion? Thanks! Hen ... View more

Hi All, I've installed CIM (same installation file) on 2 search heads. both of them with the same configuration, same Splunk Enterprise version, same OS. using Chrome in both servers. How is possible to have different UI? Can I keep going with the configuration on both of them? or is it wrong? I've tried to remove the CIM -> splunk restart -> installed CIM -> splunk restart And it happened again. Please assist, Hen. ... View more