Does anyone happen to know if there is a default time range from eventhub input from Splunk Add-on for Microsoft Cloud Services and where the checkpoint value is stored?  I am unable to find out the information from https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureeventhubs. Thanks. ... View more

I am using "sendresults" command and pass the search results to an email body template; however, the search results didn't show up from the body.  Unfortunately, the Splunk sendresults page doesn't have an example for passing the result to the email body.  I wonder if it is possible to pass search results to the email body.  Does anyone know?   This is the sample code I used.     | makeresults | eval score=90, email_to="john.doe@xyz.com", name="john" | append [|makeresults | eval score=76, email_to="jane.doe@abc.com",name="jane"] | fields - _time | sendresults showresults=f subject="Your Score" body="Hi $result.name$", your score is $result.score$."       ... View more

I have Splunk 8.0.7 in core and Splunk Machine Learning Toolkit in version 5.2.0.  Splunk backend is still running Python 2.7.17.  How can I tell what Python version is running at Splunk MLTK App?  Also, I followed the following post, How to run Splunk using python 3.7, I either added "python.version = force_python3" or "python.version = python3", but Splunk is still running Python 2.7 from the backend.  Any ideas? Thanks. ... View more

Does anyone know where the last checkpoint value or file from a DB input via DB Connect 1?  Thanks. ... View more

Is there a document in Splunk show how to upgrade Splunk DB Connect 1 to DB Connect 3?  Thanks. ... View more

Hi, I installed Vertica database driver on my DB Connect (3.4.0).  I downloaded the driver and extracted to my local machine and upload only the jar file to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/drivers; however, I tried version  7.1, 7.2, 9.0, and 10, DB Connect didn't recognize Vertica database driver at all.  Did I miss any steps or make any mistake?   thanks ... View more

Hi.  I have a DB output job constantly failed with the following error:   ERROR org.easybatch.core.job.BatchJob - Unable to read next record java.lang.RuntimeException: javax.xml.stream.XMLStreamException: ParseError at [row,col]:[123123,23423] Message: The reference to entity "g" must end with the ';' delimiter. ...    I have tested multiple times with the same data set, but it failed with ParseError in different positions with different messages.  My DB Connect is in version 3.1.4 installed in Splunk version 7.2.5.   Does anyone have any clues?    Thanks. ... View more

I have a DB ouput job sending around 6 to 8 millions records to a MSSQL database daily.  This job failed frequently; however, I don't see any valuable messages from internal logs to tell why the job failed.  Any clues what could be the reasons the job failed? Thanks, Lucas ... View more

I wonder if Splunk internal logs contain any information such as the expiry of the services on a Splunk addon. Thanks. ... View more

I installed Splunk App for Web Analystics, the datamodel status (of WebAnalytics) shows in "Building"; however, the status was never updated and there was no data ingested to the datamodel although there was data available within the datamodel constraints. Any clues? Thanks. ... View more

We have more than 90% of skipping rate from our datamodel acceleration searches, and most of them show like 99.96% completed from status. Should I concern about those skipping searches? Does the skipping search cause the data lost or delayed from the data model? From health monitor, what aspects should I look into? Thanks. ... View more

According to Splunk document in "tstats" command, the optional argument, fillnull_value, is available for my Splunk version, 7.2; however, this optional argument doesn't seem working at all. I got an error message: "... The argument 'fillnull_value=NA' is invalid". Does anyone have any clues? Thanks. | tstats summariesonly=true fillnull_value="NA" count from datamodel=Email.All_Email where * by All_Email.src_user ... View more