Hello @kiran_panchavat  @Rhidian  maybe we could filter special characters with REGEXP_REPLACE(sql_text… in the SQL query? Thanks. ... View more

Hello @livehybrid  looks like the json is from Vector agent to Kafka, that's why we may end up with json or is it possible to convert json to raw log in Splunk? ... View more

Not at this time. Splunk can auto-extract values only if the whole _raw message consists of the structured data blob. There is an open idea on ideas.splunk.com - https://ideas.splunk.com/ideas/EID-I-208 It is marked as future prospect but of course voting on this issue might provide some additional push. The alternative would be to cut the remainder of the event so that only the json part is left but this way you're losing some data. ... View more

Hello @splunkreal, Yes, you'll need to define the outputs.conf on Indexers1 to forward the logs to indexers2. If you wish to send all the logs of indexers1 to indexers2, you can definitely use the defaultGroup parameter in outputs.conf. However, if you wish to send only a few logs from indexers1 to indexers2, it would be better to use _TCP_ROUTING in inputs.conf for those particular inputs.   Thanks, Tejas. --- If the above solution helps, an upvote is appreciated..!!  ... View more

Hi @Jacob_Edelen , Schedule PDF delivery was added in 9.3. You can check out our "What's new in Dashboard Studio" docs to see new features shipped with each version: https://docs.splunk.com/Documentation/Splunk/9.4.2/DashStudio/WhatNew#:~:text=Schedule%20PDF%20and%20PNG%20exports%20of%20dashboards ... View more

Yes this has added recently into official documentation. But currently there are still e.g. appinspector which didn't accept it in Cloud vetting. What I have heard this will be fixed soon, so then you could use it officially with Cloud too. ... View more

metadata is not reliable compared to tstats, with tstats I get accurate lastTime field info. ... View more

Two small points:  1. I would avoid the usage of the /lib directory in app code. It was intended to work around an issue that no longer exists (outside of persistent custom REST endpoints) and causes additional issues for extension points that distribute resources to search peers (i.e. certain types of custom search commands and external lookups) - you will need to update .conf files to make sure that the /lib directory is distributed correctly. There are no advantages to using /lib over /bin and /bin is automatically distributed to search peers as required.  2. Similarly, the guidance to do import manipulation using sys.path.insert is also outdated, as it does not prevent import collisions within the context of persistent custom REST endpoints).    e: In the context of a scripted input it shouldn't matter either way. I just want to make sure it's understood where the /lib guidance came from and why it is out of date today.  I'm working to get the old guidance removed from dev.splunk.com and examples on github - appreciate your patience in the meantime.  ... View more

I've done this little app in order to adress this specific use case : https://github.com/kilanmundera/Custom-Annotations-Framework-for-Splunk-Enterprise-Security ... View more

@jkat54 Hello, I find out I get lastTime tstats metadata from export api endpoint ran from CLI and not getting this lastTime field on web search with same query, even if lastTime info is from last year from offline UF. I guess there is maybe web filtering. This only applies to single result though. Results can be different I guess due to different user/role, app context, api endpoint which may be my case. Thanks. ... View more

Short documentation reminder: https://docs.splunk.com/Documentation/DBX/3.18.2/DeployDBX/Prerequisites "KV store must also be active and working properly as of DB Connect version 3.10.0 and higher" ... View more

Hello, we found solution, there was metadata index source key that was possible to use. Thanks for your help guys. ... View more

We have the same issue after scanning on Version: 9.4.0 How can we fix it?  Thank you ... View more

Hello @NoSpaces did you report to support as this looks like splunk init shcluster-config bug? ... View more

Hello, thanks for your help, had similar issue due to splunk init shcluster-config, secret key wasn't correctly encrypted in server.conf apparently, as seen with help of splunk show-decrypted ... View more

Have you activated eventgen's inputs on Splunk side? ... View more

I have always that "chown -R splunk:splunk" on my ansible or other scrips which are used for installation and/or update splunk nodes. This has safe me a lot of time 😉 ... View more

@JLange  you're welcome 🙂 ... View more

Hi as @VatsalJagani already said that error message didn’t relate to you login issue. It’s just told that your DB connect didn’t work as kvstore is somehow broken/stop. On splunkd.log should be some lines which could help us to see what was a real issue. But let’s start that migration part as it’s quite obvious that it has something to do with this issue! From where you migrated it and what is target environment? How do you do the migration? Was there any issues before migration? Anything else we should know? r. Ismo ... View more

It's a bit philosophical issue. Firstly, there can be many things done on HFs. Some people run modular inputs on them, some have them just for receiving HEC, others have a "parsing layer" before sending data to indexers. So there are several different use cases. As a rule of thumb it's best to use DS to distribute apps to forwarders regardless of what kind of forwarders they are. There are some caveats though. Most importantly, many modular inputs require interactive configuration from webui. And those can create configuration items which might: 1) Hold sensitive data like authorization info for external services 2) Be encrypted in a way that is not transferable between forwarders. So you might end up in a situation where you might not want to distribute a particular app and its settings centrally. As for me, assuming you can do that (because either the above-stated points do not apply or are of no concern) I'd deploy an app like that on a testing rig, create configuration for a given input, capture the resulting conf files and add them to an app pushed from DS to the production environment. ... View more

Yes, packaging your content into an app is a good practice but it shouldn't matter much if it's in apps/<app>/local or system/local for actually running the config (unless the settings get overwritten of course). And no, timestamp doesn't have to be in US format. That's what time parsing sourcetype settings are for. But back to the @joewetzel63 's issue - did you try running the script "as Splunk"? With splunk cmd /opt/splunkforwarder/bin/scripts/whatever.sh ... View more

Hello @richgalloway found out | tstats ... by source provides less results than | tstats ... values(source)  in a search combining a query joined with tstats 🙃 | tstats min(_time) as firstTime max(_time) as lastTime values(source) as source WHERE index=* by host,index provides ALL sources | tstats min(_time) as firstTime max(_time) as lastTime WHERE index=* by host,index,source provides only 1 source ... View more

You may use /opt/splunk/bin/genRootCA.sh to regenerate ca.pem & cacert.pem ... View more

See my reply here if it can help https://community.splunk.com/t5/Deployment-Architecture/Splunk-Storage-Sizing-Guidelines-and-calculations/m-p/708258/highlight/true#M29013 ... View more

https://docs.splunk.com/Documentation/ES/8.0.1/Install/InstallSplunkESinSHC#Differences_between_deploying_on_a_search_head_and_a_search_head_cluster_environment I think the rest of the SHC ES installation is mistakenly copied and not adjusted from the single-instance. This manual could use a feedback. ... View more