[script://$SPLUNK_HOME/etc/apps/serial_numbers/bin/test.sh] disabled = false host = PoC_test index = snmp interval = 60.0 sourcetype = serial_custom source = PoC_test when my script contains folowing, it will not provide anything to Splunk !/bin/sh /usr/bin/snmpget -v1 -O0 -c public poc_test IF-MIB::ifPhysAddress.1 but this works fine: !/bin/sh /usr/bin/snmpget -v1 -c public poc_rm IF-MIB::ifPhysAddress.1 anyone know where is the problem ? ... View more

I am trying to get lookup results into accelerated datamodel, but no luck so far. I am using network_traffic datamodel, where I have added new auto extracted field. I have tried to setup automatic lookup, which returns that field. I have confirmed that it is working correctly in search. Permissions are global, everybody has Read, admin Write. when I use |tstats summary only, it will return that field as empty, when I do same command without summary only, it will return field value correctly Secondly I have removed automatic lookup and added that lookup directly into datamodel as lookup field. I selected correct lookup, filled all fields and the preview shows everything is fine. During DM acceleration I end up with error , "lookup could not be found or accessed ...." Went through all the permissions but no problem there. IT this some kind of bug in Splunk ? ... View more

When I select adaptive thresholding in Service Definition, it mentions "Adaptive Thresholding runs everyday around midnight and updates the thresholding for the KPI based on the settings below. Once updated, old thresholds cannot be recovered." but it is not updating anything. After month I had to open every single service and manually had to Apply Adaptive Thresholding to get it updated. How do I run this using scheduled search instead of opening every single KPI out of 500+ applying manually ? ... View more