Does anyone happen to know if there is a default time range from eventhub input from Splunk Add-on for Microsoft Cloud Services and where the checkpoint value is stored?  I am unable to find out the information from https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureeventhubs. Thanks. ... View more

I am using "sendresults" command and pass the search results to an email body template; however, the search results didn't show up from the body.  Unfortunately, the Splunk sendresults page doesn't have an example for passing the result to the email body.  I wonder if it is possible to pass search results to the email body.  Does anyone know?   This is the sample code I used.     | makeresults | eval score=90, email_to="john.doe@xyz.com", name="john" | append [|makeresults | eval score=76, email_to="jane.doe@abc.com",name="jane"] | fields - _time | sendresults showresults=f subject="Your Score" body="Hi $result.name$", your score is $result.score$."       ... View more

I have Splunk 8.0.7 in core and Splunk Machine Learning Toolkit in version 5.2.0.  Splunk backend is still running Python 2.7.17.  How can I tell what Python version is running at Splunk MLTK App?  Also, I followed the following post, How to run Splunk using python 3.7, I either added "python.version = force_python3" or "python.version = python3", but Splunk is still running Python 2.7 from the backend.  Any ideas? Thanks. ... View more

Does anyone know where the last checkpoint value or file from a DB input via DB Connect 1?  Thanks. ... View more

Is there a document in Splunk show how to upgrade Splunk DB Connect 1 to DB Connect 3?  Thanks. ... View more

Hi, I installed Vertica database driver on my DB Connect (3.4.0).  I downloaded the driver and extracted to my local machine and upload only the jar file to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/drivers; however, I tried version  7.1, 7.2, 9.0, and 10, DB Connect didn't recognize Vertica database driver at all.  Did I miss any steps or make any mistake?   thanks ... View more

Hi.  I have a DB output job constantly failed with the following error:   ERROR org.easybatch.core.job.BatchJob - Unable to read next record java.lang.RuntimeException: javax.xml.stream.XMLStreamException: ParseError at [row,col]:[123123,23423] Message: The reference to entity "g" must end with the ';' delimiter. ...    I have tested multiple times with the same data set, but it failed with ParseError in different positions with different messages.  My DB Connect is in version 3.1.4 installed in Splunk version 7.2.5.   Does anyone have any clues?    Thanks. ... View more

I have a DB ouput job sending around 6 to 8 millions records to a MSSQL database daily.  This job failed frequently; however, I don't see any valuable messages from internal logs to tell why the job failed.  Any clues what could be the reasons the job failed? Thanks, Lucas ... View more