Hello, I have a CSV file that I monitor via the Universal Forwarder (UF). I’m encountering an issue where sometimes I cannot find the fields in Splunk when i run index=myindex, even though they appear on other days. The CSV file does not contain a header, and the format of the file is the same every day (each day starts with an empty file that is populated later). Here is the props.conf configuration that I’m using:     [csv_hff] BREAK_ONLY_BEFORE_DATE = DATETIME_CONFIG = FIELD_NAMES = heure,id,num,id2,id3 INDEXED_EXTRACTIONS = csv KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = heure TIME_FORMAT = %d/%m/%Y %H:%M:%S category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true     Has anyone else encountered the same problem? Splunk version 9 Thank you ... View more

Hello, I'm facing an issue when trying to create a user or access to savedsearch list. for example When I use the Splunk web interface to create a user, the page remains blank and doesn't display as expected, as shown in the screenshot. Additionally,     I attempted to create a user through the CLI using the "splunk add" command, but I received no response, as indicated in the screenshot.     Have you encountered this problem before? How can I debug it? I'd like to mention that even when I attempt to view saved searches, the page remains blank and doesn't display them. Thank you ... View more

Hello, I'm facing an issue when trying to create a user or access to savedsearch list. for example When I use the Splunk web interface to create a user, the page remains blank and doesn't display as expected, as shown in the screenshot. Additionally,   I attempted to create a user through the CLI using the "splunk add" command, but I received no response, as indicated in the screenshot.   Have you encountered this problem before? How can I debug it? I'd like to mention that even when I attempt to view saved searches, the page remains blank and doesn't display them.   Thank you ... View more

Hello, I have a problem after upgrading splunk from 8.1.7.1 to 9.0.2. the Splunk service starts the first time (after I run splunk start), and after a few seconds splunk stops. Before, there was no such problem. the Spkunk logs I can't find a message that indicates the source of the problem. here are the errors i found: is there anyone having the same problem as me? Thanks in advance   ... View more

Hello, We encounter this type of message in the Splunk Serch Head, which causes the restart of the splunk service and the delays at the level of the Splunk web login page, dashbords display. Have you encountered this type of problem? if so what is it (this type of messag is not clear)? Splunk Entreprise, Search Head 8.x.x   Thank you [build 545206cc9f70] 2021-08-27 11:21:24 Received fatal signal 11 (Segmentation fault). Cause: No memory mapped at address [0x0000000000000008]. Crashing thread: BundleReplicatorThread Registers: RIP: [0x00007F5BF348CC24] ? (libjemalloc.so.2 + 0x11C24) Sep 21 10:13:16 prpgv-splksh01c kernel: [4960554.728167] splunkd[26359]: segfault at 8 ip 00007f2b51845c24 sp 00007f2b279fc868 error 6 in libjemalloc.so.2[7f2b51834000+49000]   ... View more

Hello, We have a problème with Splunk Search head, the splunk service is restarted randomly when using the launch request or consultation of the dashbord. After the analysis we find kernel messages at the log level. Do you have any idea about this type of message. Sep 21 10:13:16 splksh01c kernel: [4960554.728167] splunkd[26359]: segfault at 8 ip 00007f2b51845c24 sp 00007f2b279fc868 error 6 in libjemalloc.so.2[7f2b51834000+49000] Sep 21 11:10:55 splksh01c kernel: [4964014.055174] splunkd[8210]: segfault at 68 ip 00007f816fdc749f sp 00007f81443f4da0 error 4 in libjemalloc.so.2[7f816fd9b000+49000] Sep 21 11:27:01 splksh01c kernel: [4964980.155146] splunkd[29689]: segfault at 68 ip 00007fa3888013d9 sp 00007fa3571fd200 error 4 in libjemalloc.so.2[7fa3887d5000+49000] Sep 21 12:03:54 splksh01c kernel: [4967193.444921] splunkd[9885]: segfault at 68 ip 00007fb56962b3d9 sp 00007fb5339fd240 error 4 in libjemalloc.so.2[7fb5695ff000+49000] Sep 21 12:54:45 splksh01c kernel: [4970243.694017] splunkd[12378]: segfault at 68 ip 00007f629482f49f sp 00007f626affc930 error 4 in libjemalloc.so.2[7f6294803000+49000] Sep 21 13:23:16 splksh01c kernel: [4971954.661062] splunkd[10366]: segfault at 8 ip 00007f3c111c4c24 sp 00007f3bd73fd568 error 6 in libjemalloc.so.2[7f3c111b3000+49000] Sep 21 14:23:26 splksh01c kernel: [4975565.162362] splunkd[8340]: segfault at 7f713ff89f40 ip 000055981749198f sp 00007f71419fa180 error 6 in splunkd[559814297000+40f3000]         ... View more

Hello Splunker's I programmed a saved search with a send webhook data action to send the result in json format. I noticed that the data sent contains additional information like app name eand result_link: INFO -: {"app" => "search", "results_link" => "http: // splk-sh: 8000 / app / search / search? .... In fact, I don't want to display this information on my results; i searched in advanced actions i found: action.webhook.command: sendalert $action_name$ results_file="$results.file$" results_link="$results.url$" i tried to delete result_link but it doesn't work.  did you encounter this problem on whebook or even email action can be the same. Thank you ... View more

Hello Splunker's I programmed a saved search with a send webhook data action to send the result in json format. I noticed that the data sent contains additional information like app name eand result_link: INFO -: {"app" => "search", "results_link" => "http: // splk-sh: 8000 / app / search / search? .... In fact, I don't want to display this information on my results; i searched in advanced actions i found: action.webhook.command: sendalert $action_name$ results_file="$results.file$" results_link="$results.url$" i tried to delete result_link but it doesn't work.  did you encounter this problem on whebook or even email action can be the same. Thank you ... View more

Hello Splunker's: I have a problem with the selection of the latest time at the Time range Dashboards: I open the time range I select the start time and the end time The problem is that after the click on apply the end time not change, it only modifies the start time and I have to reopen the time range and modify the end time.   Do you have same problem?   Thank you 🙂 Splunk-version: 8 ... View more

Hello, I have this INFO message: INFO BucketMover - will attempt to freeze bkt="/opt/splunk/var/lib/splunk/idx/db/rb_1588633961_1588517402_205_9C902924-4080-41E4-B824-9B4D721A8889" reason=" maxTotalDataSize" I want re-index the bucket removed but i can't find it, for example i run: find /opt/splunk/ -name "rb_1588633961_1588517402_205_9C902924-4080-41E4-B824-9B4D721A8889" but no result. Can i index data removed after the max size reashed.   Thank you. ... View more

Hello Splunker's 🙂: I have a problem with the Splunk export button; when I export my table and I open it in Excel I find problems with special characters for example: SÃ@©curité, 321801. I searched and I found a JS code which allows to change the encoding: https://community.splunk.com/t5/Getting-Data-In/Export-to-csv-on-click-of- button/td-p/444724 My question is how I can link this code with the export button of Splunk? Thank you for your help. ... View more

Hello Splunker, I'l tryin to use application to search Vendor I installed the application MAC Address Vendor Lookup for Splunk (https://splunkbase.splunk.com/app/4308/) to recover the Vendor based on the MAC address, but I find the following error. [Indexer1] Script execution failed for external search command '/opt/splunk/var/run/searchpeers/SH-XXXXXX/apps/TA-mac-address-vendor-lookup/bin/mac_vendor_lookup.py' . Info: The application is installed in Search Head. I have a cluster mode Can you help please. Thank you 🙂 ... View more