Check the #dbconnect Slack channel on Splunk Community.  I posted the way to do it on there. ... View more

I figured this out eventually btw,  and have been using it successfully since Sep 2024.  I posted the tricks to make it work in the DB Connect Slack channel.  (#dbconnect) If anybody needs help and can't find that, hit me up @Colby Mahan on Splunk Community Slack channel. ... View more

I have the same question ... View more

Exactly what I needed and all I had to do was substitute my field names.  Worked like a charm.  Karma for you.  Thanks ! ... View more

87 views of my question and zero comments.  Same question posted by a different person 3 years ago and no answer to them either.  It seems like no one responsible for this product actually looks at the questions.  A reply that states "this is not possible or will never be implemented" is preferable to complete silence.  Even better would be acknowledging the use case as valid and committing to adding the feature or providing a workaround such as code that could be inserted into the app configuration to enable it as a custom feature. ... View more

Has anyone found a solution or workaround for this?  ... View more

Update -  I reverted to the old version of the normalizer import and it fixed the issue of entities going to "unstable".  After consecutive runs of the imports all my entities are staying in Active status.  As mentioned in last post I believe this is because once an import runs against an entity, it has to successfully run again at every cycle.  Since the entities are not returned by the updated version that excludes entities that already have a title, they become unstable.  ... View more

This "fix" seems to introduce a new problem.    The Status for all these entities will become Unstable in the Infrastructure overview.  The status is determined by whether or not the initial imports complete successfully on subsequent cycles.  Since this normalizer will only run the first time, and skip all entities on subsequent runs, only the main import will show as completed and the status goes to unstable.   In the example below you can see that the windows import completed "just now" but the normalizer import shows the epoch time of last Friday, when I had deleted all my entities and let the imports start fresh.  After the first run, all the entities were green and active, but as soon as the next cycle ran, they all went to Unstable.     ["combined=unstable", "itsi import objects - windows os hourly entity import=just_now", "itsi import objects - itsi_entity_name_normalizer=1663960530.1300445"] ... View more

actually yours is SQL, but same idea for Oracle i would think... ... View more

Did you mean that the logs are not parsing as Oracle events? That's what I am running in to. I have all the metrics and logs pulling from cloudwatch / cloudwatch logs - but am having trouble figuring out how to run them through the Oracle Add on which is what would parse the logs. The AWS app is just looking at the perf metrics and descriptions but doesn't have anything native for the DB logs. How did you solve that part? ... View more

Update - I noticed I gave the wrong app. You asked about the general Infrastructure App. The answer is still similar. splunk_app_infrastructure\default\data\ui\views\ There are not a "ton" there are 6 pre-configured views. Alerts Configure entities investigate metrics analysis settings ... View more

Why yes there are! Look here: splunk_app_windows_infrastructure\default\data\ui\views\ There are a ton in that location. Just paste the text contents of the one you want into the Edit - Source area of a newly created dashboard. ... View more

Has anyone successfully implemented this workaround? We are not having any luck. ... View more

Yes they are VMs. I think I found a workaround by setting the desired name in deploymentclient.conf I manually added it and restarted services and deployment server picked it up and sent the app. Final test is to see if adding that to automation process will allow hands off app install when deployed. ... View more