Update -  I reverted to the old version of the normalizer import and it fixed the issue of entities going to "unstable".  After consecutive runs of the imports all my entities are staying in Active status.  As mentioned in last post I believe this is because once an import runs against an entity, it has to successfully run again at every cycle.  Since the entities are not returned by the updated version that excludes entities that already have a title, they become unstable.  ... View more

This "fix" seems to introduce a new problem.    The Status for all these entities will become Unstable in the Infrastructure overview.  The status is determined by whether or not the initial imports complete successfully on subsequent cycles.  Since this normalizer will only run the first time, and skip all entities on subsequent runs, only the main import will show as completed and the status goes to unstable.   In the example below you can see that the windows import completed "just now" but the normalizer import shows the epoch time of last Friday, when I had deleted all my entities and let the imports start fresh.  After the first run, all the entities were green and active, but as soon as the next cycle ran, they all went to Unstable.     ["combined=unstable", "itsi import objects - windows os hourly entity import=just_now", "itsi import objects - itsi_entity_name_normalizer=1663960530.1300445"] ... View more

actually yours is SQL, but same idea for Oracle i would think... ... View more

Did you mean that the logs are not parsing as Oracle events? That's what I am running in to. I have all the metrics and logs pulling from cloudwatch / cloudwatch logs - but am having trouble figuring out how to run them through the Oracle Add on which is what would parse the logs. The AWS app is just looking at the perf metrics and descriptions but doesn't have anything native for the DB logs. How did you solve that part? ... View more

Update - I noticed I gave the wrong app. You asked about the general Infrastructure App. The answer is still similar. splunk_app_infrastructure\default\data\ui\views\ There are not a "ton" there are 6 pre-configured views. Alerts Configure entities investigate metrics analysis settings ... View more

Why yes there are! Look here: splunk_app_windows_infrastructure\default\data\ui\views\ There are a ton in that location. Just paste the text contents of the one you want into the Edit - Source area of a newly created dashboard. ... View more

Has anyone successfully implemented this workaround? We are not having any luck. ... View more

Yes they are VMs. I think I found a workaround by setting the desired name in deploymentclient.conf I manually added it and restarted services and deployment server picked it up and sent the app. Final test is to see if adding that to automation process will allow hands off app install when deployed. ... View more