I am getting the below error while running Splunk integration spring adapter. org.xml.sax.SAXParseException; lineNumber: 16; columnNumber: 212; schema_reference.4: Failed to read schema document 'http://www.springframework.org/schema/integration/splunk/spring-integration-splunk.xsd', because 1) could not find the document; 2) the document could not be read; 3) the root element of the document is not <xsd:schema>. I tried to search http://www.springframework.org/schema/integration/splunk/ but it looks like it is not reachable. Has Spring deprecated the support of Splunk? My bean configuration looked like this: <?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:int="http://www.springframework.org/schema/integration" xmlns:int-splunk="http://www.springframework.org/schema/integration/splunk" xmlns:stream="http://www.springframework.org/schema/integration/stream" xmlns:context="http://www.springframework.org/schema/context" xsi:schemaLocation="http://www.springframework.org/schema/integration/stream http://www.springframework.org/schema/integration/stream/spring-integration-stream.xsd http://www.springframework.org/schema/integration/splunk http://www.springframework.org/schema/integration/splunk/spring-integration-splunk.xsd http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.4.RELEASE.xsd">; <import resource="SplunkInboundChannelAdapterCommon-context.xml"/> <int-splunk:inbound-channel-adapter id="splunkInboundChannelAdapter" auto-startup="true" search="sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | where '3' > 0" splunk-server-ref="splunkServer" channel="inputFromSplunk" mode="realtime" initEarliestTime="-1d"> <int:poller fixed-rate="5" time-unit="SECONDS"/> </int-splunk:inbound-channel-adapter> </beans> ... View more

I want to use the following Splunk apps in the production environment. Kafka messaging modular input AMQP messaging modular input Hadoop Connect Hunk App for Hbase Alert manager Can anyone please let me know do I need to buy the licenses for each one of them? Will it not be covered in the Splunk Enterprise license which I will be buying in some days? Swift reply would be much appreciated. ... View more

I am calculating distance between the 2 latitude and longitude and if the distance > 0, then it will return the event or else it does not do anything. An event contains a Json message body. Following is the search I am using, but it is giving me an error. sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | eval distance=sqrt(pow('13'-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval lat2=pickup_latitude | return $lat2],2)+pow('5'-[search sourcetype=SplunkKafka_messaging | spath input=msg_body | eval long2=pickup_longitude | return $long2],2)) | eval result = if (distance>0, [search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body], [search sourcetype=SplunkKafka_messaging | spath input=msg_body]) | return $result Error: Error in 'eval' command: Typechecking failed. The '==' operator received different types. I have to use this search in real-time. Update: In the search , '13' & '5' are the column indexes and not the numeric value. ... View more

I want to do something like the below command but it is giving me an error. sourcetype=SplunkKafka_messaging | spath input=msg_body | where passenger_count > [sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | stats avg(passenger_count)] Error: Unknown search command 'sourcetype'. Can anyone let me know how to achieve the objective? My aim is to extract the events where passenger_count is greater then the average of that column. This will happen in real time. ... View more

I am getting the below error when I am pushing json data to the exchange. 05-21-2016 14:01:56.567 +0530 ERROR ExecProcessor - message from "python /usr/local/splunk/etc/apps/amqp_ta/bin/amqp.py" Caused by: com.rabbitmq.client.ShutdownSignalException: channel error; protocol method: #method(reply-code=404, reply-text=NOT_FOUND - no previously declared queue, class-id=50, method-id=20) Using rabbitmq_server-3.6.1 and the latest version of AMQP Messaging Modular Input ... View more

I am using both the Splunk Add-on for Kafka and Kafka Messaging Modular Input for comparison. When I am configuring it from Splunk Web, it is giving me the following error: Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/launcher/data/inputs/kafka: ('The read operation timed out',)",) Can anyone let me know what to change to rectify it? ... View more