Any news on support for 8.1.x or 8.2.x? ... View more

Hello @ibmresilient , It's been 2 years but I'm facing this issue and I raised a case to IBM but unfortunately they confirmed that this app is not supported on SHC and they'll upgrade the app for SHC till end of 2021 Q1 .  I'd like to ask you guys how you manage this app on SHC ?  you may have different workaround for that.    Thanks in advance     ... View more

Perfect, that works fine to me. ... View more

Hello Yanick, To address your question in regards to setting up Multiple Heavy Forwarders (or Universal Forwarders) to watch the same Log files on an NFS Mount, you are correct this would cause a "Multiple" ingestions of the same Log, so you would see duplicate entries. The best solution for this type of setup to monitor your Clustered Applications logs that are being written to an NFS Share would be to install the Splunk Universal Forwarder or Heavy Forwarder, depending on your needs, on the NFS Server. You would then configure the Universal Forwarder/Heavy Forwarder to monitor the Logs that your Cluster Application is writing to on the NFS Share. The Universal Forwarder is a "Light Weight" version of Splunk that only forwards data to the Indexers for ingestion. The following link will provide information on the Splunk Universal Forwarder: http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Abouttheuniversalforwarder Now with that being said, alternatively you could have each of the Clustered Application Servers write to local logs and then use the Heavy Forwarder/Universal Forwarder installed on those Servers to monitor the Application Logs. This would provide a means of "tracking" possible issues based on Host Server sending the log data to the Indexers. Thanks, Jeff Thompson ... View more

This parameter in server.conf is a timer. restart_timeout = <positive integer> * Only valid for mode=master * This is the amount of time the master waits for a peer to come back when the peer is restarted (to avoid the overhead of trying to fixup the buckets that were on the peer). * Note that this only works with the offline command or if the peer is restarted vi the UI. * Defaults to 60s. The CM calls the restart of a peer, and waits for this duration for the indexer to check back in again. If your indexers take longer that duration to check back in, the CM calls the next peer restart anyway and you end up with mutliple indexers restarting at the same time. We have this set to about 30 minutes because our indexers take ages to restart. Hopefully a splunk person can tell me that behaviour is now fixed. ... View more

Thanks for the inputs on this issue @Damien Dallimore Could you please help with below scenario? I am having similar issue running the app on splunk universal forwarder, running on s390x linux. when I enable the app, it sends one set of jmx output and displays following error messages. ERROR Can't connect to Splunk REST API with the token, either the token is invalid or SplunkD has exited : null "ERROR It has been determined via the REST API that all inputs have been disabled" and the PID from SPLUNK4JMX.pid file doesnt exist on running processes and doesnt trigger the modinput again ( I guess the inputs are disabled from the error message). Enabling app through command line triggers another one time jmx output. ... View more

Support resolved this issue for me and thus I'm passing along to resolve everyone else. 🙂 If you're using DBX 1.2.2 and have MS SQL Server with Windows Auth, you need to do this: cd $SPLUNK_HOME/etc/apps/dbx/bin/lib/ mv jtds-1.2.6.jar jtds-1.2.6.jar.org wget http://sourceforge.net/p/jtds/bugs/_discuss/thread/16113049/f77e/4151/f53d/attachment/jtds-1.3.1-v20140512.jar --ensure you have java 8 installed (i.e. java -version) restart Splunk If you're using DBX 1.2.2 and have MS SQL Server with sa authentication, you need to do this: 1. Download the zip from Microsoft here: https://www.microsoft.com/en-us/download/details.aspx?id=11774 Get the sqljdbc42.jar and put it in dbx/bin/lib/ folder (dont put the sqljdbc4 or 4.1 there) Per http://docs.splunk.com/Documentation/DBX/1.2.2/DeployDBX/Installdrivers do the following: 3a. edit $SPLUNK_HOME/etc/apps/dbx/local/database_types.conf 3b. add this [generic_mssql] displayName = MS-SQL Server Using MS Generic Driver jdbcDriverClass = com.microsoft.sqlserver.jdbc.SQLServerDriver connectionUrlFormat = jdbc:sqlserver://{0}:{1};databaseName={2};selectMethod=cursor defaultPort = 1433 defaultCatalogName = master testQuery = SELECT 1 now change your MS SQL configuration (databases.conf) to match. (ie change type=mssql to type=generic_msssql) recycle splunk ... View more

Has there been any updates to this issue using DB Connect 1 or 2? ... View more

Yanick, did this ever get into a git repo ? I have been making this work in our environment and I have some fixes which might help (and some questions if you have time) ... View more

Simony - this is a problem. If you're developing an app and distributing it to third parties, then you are in violation of the Sideview Free Internal License Agreement. Sideview Utils 2.X is free for internal use, but basically for companies who are using it as a dependency of commercial apps, they need a Sideview OEM license. I know of several spps in the ecosystem built on Sideview Utils 2.X, but they all have Sideview OEM licenses. I'm afraid I was not aware until now that Splunk for Puppet required SVU 2.X. email me at nick [at] sideviewapps.com ... View more

Your input was certainly a little help. Nevertheless I had to open a case with splunk. They have then created my app package new. The reason why i can't upload the package first they did not tell me. But at the end I could upload the package. ... View more

Simony, I just downloaded and installed the puppet app. So far it work great, but I'm missing the file auto_serverlist.csv! I was able to create the file serverlist_umgebung.cvs with the help of you answer above, but I can't find any hint on serverlist_umgebung.cvs. Can you please post the label for serverlist_umgebung.cvs? This would help my very much to proceed with a successful installation. ... View more