The app packager appends TA- to the folder name when building an app.  I realize some portions of ES use this folder name to load props/transforms just based on the TA- prefix.  There could be other reasons I'm not aware of. My questions is there a way to remove/turn off this function of appending TA- to the folder name?  Even if it's needed on the ES search head it's not needed in other areas of the deployment.  My company has used a naming standard to help keep things separated and well defined for what the app is for based off the folder name.  I'm now starting to get requests to deploy in house developed apps that have been built using this app builder and of course they are all appended with TA- which throws a wrench in the naming standard we have used for years.  We've had those before but they were limited to Splunk Base apps which also fits into our naming standard as up until this point I could say with 99% probability anything with TA- in the folder name was a Splunk Base app, now that is no longer true. ... View more

We have three different instances of Qualys to gather data from. This will require the app be installed on three different Forwarders to provide the credentials for three different connections. There is no security need to separate the data on the Splunk indexers to three different indexes. Can we change the sourcetype for each instance to add like _instance1 to the end in order to separate the data between the three inputs while still putting it all in one index? This would require some code modification on the reports and searches as well to look for the new sourcetype names. Just don't want to have three indexes setup for this if we can modify the sourcetype names to do the same thing. ... View more

Tryin to setup SNMP_TA to monitor a port for SNMP traps being sent. When looking at which ports are listening using the command "netstat -plunt", I'm never seeing 1056 show up as listening. 1056 is the port I have in my input, which looks like this: [snmp://pnet] activation_key = XXXXXXXXXXXXXXXX communitystring = portal do_bulk_get = 0 do_get_subtree = 0 ipv6 = 0 snmp_mode = traps snmp_version = 1 sourcetype = snmp index = snmptrap split_bulk_output = 0 trap_port = 1056 trap_rdns = 0 v3_authProtocol = usmHMACMD5AuthProtocol v3_privProtocol = usmDESPrivProtocol These are the errors in the internal log 12-17-2018 10:27:03.441 -0600 ERROR ExecProcessor - message from "python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py" ValueError: Empty module name 12-17-2018 10:27:03.441 -0600 ERROR ExecProcessor - message from "python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk01/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 103, in _init 12-17-2018 10:27:03.441 -0600 ERROR ExecProcessor - message from "python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk01/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 45, in init 12-17-2018 10:27:03.441 -0600 ERROR ExecProcessor - message from "python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk01/etc/apps/snmp_ta/bin/pysnmp-4.2.5-py2.7.egg/pysnmp/smi/builder.py", line 199, in setMibSources 12-17-2018 10:27:03.441 -0600 ERROR ExecProcessor - message from "python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py" mibBuilder.setMibSources(*mibSources) 12-17-2018 10:27:03.440 -0600 ERROR ExecProcessor - message from "python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk01/etc/apps/snmp_ta/bin/snmp.py", line 498, in do_run 12-17-2018 10:27:03.440 -0600 ERROR ExecProcessor - message from "python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py" do_run() 12-17-2018 10:27:03.440 -0600 ERROR ExecProcessor - message from "python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py" File "/opt/splunk01/etc/apps/snmp_ta/bin/snmp.py", line 799, in 12-17-2018 10:27:03.440 -0600 ERROR ExecProcessor - message from "python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py" Traceback (most recent call last): 12-17-2018 10:27:01.159 -0600 INFO ExecProcessor - New scheduled exec process: python /opt/splunk01/etc/apps/snmp_ta/bin/snmp.py ... View more