Hello,   We're trying to setup the Azure Storage account from the add-on and we're getting authentication failure. Credential is working fine when test using Azure Storage Explorer. Only difference is client environment has certain policy. It started to work when they add the respective VNET/Subnet in storage firewall while failing with authentication error over storage account private endpoint.   Does app can support storage account connectivity through specific storage services private endpoint? from configuration perspective, we can only define the storage account name and access key.   Thanks. ... View more

I have a dashboard that show/hide panel whenever option/s in checkbox is ticked, which is already working. My problem is whenever I select the option as default value, the panel is still hidden whenever I open the dashboard. Any idea on this? or am I missing something   Heres some part of my xml. <input type="checkbox" token="check"> <label>Category Type</label> <choice value="db_gc_wait">DB GC Waits</choice> <choice value="concurrent_manager">Concurrent Managers</choice> <choice value="blocking_session">Blocking Session</choice> <choice value="longrunning_job">Long Running Jobs</choice> <choice value="crm_top_request">CRM Top Requests</choice> <choice value="workflow_mailer">Workflow Mailer</choice> <change> <condition match="$check$ = &quot;db_gc_wait&quot;"> <set token="show_db_gc_wait">1</set> <unset token="show_concurrent_manager"></unset> <unset token="show_blocking_session"></unset> <unset token="show_longrunning_job"></unset> <unset token="show_crm_top_request"></unset> <unset token="show_workflow_mailer"></unset> </condition> ... <condition match="$check$ = &quot;db_gc_wait concurrent_manager blocking_session longrunning_job crm_top_request workflow_mailer&quot;"> <set token="show_db_gc_wait">1</set> <set token="show_concurrent_manager">1</set> <set token="show_blocking_session">1</set> <set token="show_longrunning_job">1</set> <set token="show_crm_top_request">1</set> <set token="show_workflow_mailer">1</set> </condition> <!-- Unset all tokens --> <condition> <unset token="show_db_gc_wait"></unset> <unset token="show_concurrent_manager"></unset> <unset token="show_blocking_session"></unset> <unset token="show_longrunning_job"></unset> <unset token="show_crm_top_request"></unset> <unset token="show_workflow_mailer"></unset> </condition> </change> ... <row> <panel depends="$show_db_gc_wait$"> <table> <title>Database GC Waits</title> <search> <query> MY QUERY</query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> <option name="drilldown">cell</option> </table> </panel> </row> ... View more

Hello, Please help me identify my issue maybe I'm missing something I don't see. I created simple powershell script to get data from Certificate Authority server (using certutil command) then package as a splunk application. After I deployed the app in CA server with Splunk installed, then executed the script manually from powershell ISE, I can see I have an output from console. But during scheduled execution, there's no data in my index. No error in internal logs so I can't identify where is the issue. Any feedback will help. thanks. Also I already tried other workaround in other thread, still didn't work. (like using .path file, powershell stanza etc..)   My .bat file @ECHO OFF Powershell.exe -executionpolicy remotesigned -File "%~dpn0.ps1" inputs.conf [script://.\bin\scripts\get_ca_issued_certs.bat] disabled = 0 index = cert_authority_idx sourcetype = ca_issued_certs interval = 300 Internal logs: 5:41:24.397 AM   02-22-2023 05:41:24.397 -0800 INFO ExecProcessor [6372 ExecProcessor] - New scheduled exec process: "C:\Program Files\Splunk\etc\apps\cert_authority_win_uf\bin\scripts\get_ca_issued_certs.bat"   Output when manually executed. Date=2023-02-22_06:02:00_-08:00,object=Cert Authority,counter=Issued Certs Expiry,RequestID=4,RequesterName=NT AUTHORI TY\IUSR,SerialNumber=2a0000000455e56fc1482ef85f000000000004,NotAfter=2/21/2024 7:37 AM,Value=364 Date=2023-02-22_06:02:00_-08:00,object=Cert Authority,counter=Issued Certs Expiry,RequestID=5,RequesterName=NT AUTHORI TY\IUSR,SerialNumber=2a000000052914506fdbd37f24000000000005,NotAfter=2/21/2024 7:39 AM,Value=364 ... View more

Upon fresh installation or even during restart of splunk instance, it says  The Splunk web interface is at https://servername:8000 but when I tried to access the link using the said url, it's not working as well as server's fqdn https://servername.dns.test:8000 . I can only access the splunk web url using its ip address ex:  https://10.xx.x.xx:8000   Is this related to DNS setup of server? Any idea to this issue.   Thanks. ... View more

Hi All, We have a requirement to setup DB inputs to Splunk DB Connect app, but we're encountering ORA-01843:not a valid month in internal logs in one of their DBs. We didn't encounter the said error during setup via UI and successfully save the DB input. But during execution, there's no data being ingested to splunk due to the said internal error. Also their other DBs are fine just except on 1 DB. Just want to ask if someone already encountered this issue and for possible fix. Not sure if it's on Splunk side or on their DBs that need to fix. Note: they have the same DB input query for all tables. Query: select * from table1 from timestamp > ? order by timestamp Timestamp format when executing the DB from splunk app 2019-10-29 17:07:07.193 Connection Type: Oracle Service Thanks. ... View more

Hi, I just want to ask if we can enable the Lookup Editor app for multi-tenancy in a Search Head cluster. I want them to only access and edit the lookup files under their app or if it can restrict using their splunk role. Thanks. ... View more

We have a requirement that some users only need to view the dashboard(with data populated) but they should be restricted to search in splunk. Any ideas how to properly configure it via backend in authorize.conf ... View more