Hi, Unable to find the option to attach the results of an alert in service now incident while creating incident through Splunk service now add-on. is there any possibility?   ... View more

Splunk 6.3 forwarder is not sending data using SSL while Splunk 6.6 is working fine with the same settings. Following entries are added in outputs.conf on forwarder: [tcpout] defaultGroup =Splunk_Indexers [tcpout:Splunk_Indexers] disabled = false server = servername:9997 compressed = false sslRootCAPath = "splunk-home"\etc\auth\NewAuth\CARoot.crt sslCertPath = "splunk-home"\etc\auth\NewAuth\servercert.pem Following entries are added in inputs.conf on indexer: [splunktcp-ssl://9997] connection_host = ip [SSL] compressed = false password = $5SD$== requireClientCert = false rootCA = "splunk-home"\etc\auth\NewAuth\CARoot.crt serverCert = "splunk-home"\etc\auth\NewAuth\servercert.pem Can please help to fix this issue as the above settings are working fine in Splunk 6.6 forwarder but giving following error in splunkd.log on Splunk 6.3 forwarder: "Connection to host=servername:9997 failed. sock_error = 0. SSL Error = error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed" ... View more

I used following syntax to monitor a file input in windows [monitor://D:\app*\logs\a*.log] The above stanza is not indexing any file. Getting the below error in splnkd.log on forwarder FilesystemChangeWatcher - error getting attributes of path "\D:": The filename, directory name, or volume label syntax is incorrect. But when I use following input, it works. [monitor://D:\appdev\logs\a*.log] Please help. ... View more

Hi Splunk – We are trying to implement a countdown timer and seems script tags are not parsed by Splunk Web. The web simply ignores the Jquery/script tags. Can help with this or any alternate solution to get the countdown timer in on Splunk Web pages working? ... View more

Hi, I have a type of following event data which is coming from forwarder: Column1=XYZ+Column2=ABC+ColumnC=GGG.... I want to remove Column2=ABC value from the event before indexing. Can help how to filter this data. The event should be indexed like this: Column1=XYZ+ColumnC=GGG.... ... View more

Hi, I have deployment server and license master on the same machine. I am getting following frequent errors in splunkd.log file ERROR HttpListener - Error spawning thread: HTTPDispatch: about to throw a ThreadException: _beginthreadex: The paging file is too small for this operation to complete.; 8000 threads active Please provide some solution on the above error. ... View more

"Configuration initialization took 1441ms for C:\Splunk\etc" Can someone please let me know how to get rid of this warning message? ... View more

I have multiple forwarders which are sending data to one indexer at port 9997, I want to transfer data from forwarder to indexer via F5 url. I have created a F5 url like abc.companyname.com which is listening at port 80 and added my indexer in F5 mapping. Indexer is listening at port 9997 I configured my forwarder like abc.companyname.com:80 to send data to new F5. It is not working, can anyone help? ... View more

Hi, I am thinking of using the Calculated Fields option to extract one field. I have following values in a field name "YOURFIELD" Test_X TestA_Y TestBC_Z_all I want to extract the characters before "_" in a new field "MYFIELD". The result will be: Test TestA TestBC Can please help me to extract this result in calculated fields using an EVAL function or any other method? ... View more

Hi, I have to do field extraction on the following data. ****2014/02/02 10:10:10 level - test Can please help to get the regex to extract fields: Date = 2014/02/02 Time = 10:10:10 Level = level Message = Text Your help is greatly appreciated. ... View more

I have a deployment server. There are 2 serverclasses with multiple and different machine name. how can i add different machine names in serverclass.conf. I am doing like: [serverClass:A] whitelist.1 = mahcine1, machine2 [serverClass:B] whitelist.1 = mahcine3, machine4 The problem is that when I provide following and apps are being deployed on all the machines. [serverClass:A:app:winevt] stateOnClient=enabled restartSplunkd=true ... View more