Hi I am trying to onboard the streaming events from Salesforce into my Splunk and trying to use the 'Splunk Add-on for Salesforce Streaming API' for same. I have an http proxy at instance level to allow the connect to the internet facing Salesforce Sandbox Instance. After setting up the required connection and inputs, the data is not getting onboarded. And I am getting following ERROR messages at ta_sfdc_streaming_api_sfdc_streaming_api_events.log My Splunk Version : 8.1.5 How to solve this?' ################## ERROR pid=434886 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/current/etc/apps/TA-sfdc-streaming-api/bin/sfdc_streaming_api_events.py", line 66, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/input_module_sfdc_streaming_api_events.py", line 26, in collect_events loop.run_until_complete(task) File "/opt/splunk/current/lib/python3.7/asyncio/base_events.py", line 587, in run_until_complete return future.result() File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/input_module_sfdc_streaming_api_events.py", line 61, in connect_sfdc async with sf_streaming_client as client: File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/aiosfstream/exceptions.py", line 143, in async_wrapper return await func(*args, **kwargs) File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/aiosfstream/client.py", line 246, in __aenter__ return cast("Client", await super().__aenter__()) File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/aiocometd/client.py", line 432, in __aenter__ await self.open() File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/aiosfstream/exceptions.py", line 143, in async_wrapper return await func(*args, **kwargs) File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/aiosfstream/client.py", line 143, in open await authenticator.authenticate() File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/aiosfstream/auth.py", line 100, in authenticate status_code, response_data = await self._authenticate() File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/aiosfstream/auth.py", line 187, in _authenticate response = await session.post(self._token_url, data=data) File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/aiohttp/client.py", line 619, in _request break File "/opt/splunk/etc/apps/TA-sfdc-streaming-api/bin/../lib/aiohttp/helpers.py", line 656, in __exit__ raise asyncio.TimeoutError from None concurrent.futures._base.TimeoutError ... View more

Hi all, I have  indexer clusters at multiple sites, but common Search Heads. I want to remove certain indexes which holds no data. How can I find in which indexer cluster's indexes.conf , the certain indexes entries are present. Also in which deployment app of which indexer the related monitoring stanza is present. Is there any rest api command to get the details? Thanks in Advance   ... View more

Hi all, Am unable to provide a user with access to 'Alert Actions' under Splunk setting for the user to view the 'Log Events' related to the custom alerts created. As I cannot confirm the exact capability which can give access for the same. Can somebody please help. I am using the splunk version 7.2.9 Thanks ... View more

Hi, I am working on OS log onboarding data under multiple hostname folders and these hostname folders are located at same file path. My plan is to dynamically onboard these logs to indexes based on relevant hostname with dynamic sourcetype set based on filename text. My logs directory structure: \opt\myAPP\host1\filename_type1.log \opt\myAPP\host2\filename_type2.log \opt\myAPP\host3\filename_type3.log Expected index name from foldername: indexname_host1 indexname_host2 indexname_host3 Expected sourcetype name from filename : sourcetype_type1 sourcetype_type2 sourcetype_type3 Following are the configuration am using at inputs.conf , where index=route is just placeholder and no such index is created: `[monitor:///opt/myAPP/.../*.log] host_segment = 3 index = route sourcetype = reroute_1 whitelist = (host1|host4|host5) [monitor:///opt/myAPP/.../*.log] host_segment = 3 index = route sourcetype = reroute_2 whitelist = (host2) [monitor:///opt/myAPP/.../*.log] host_segment = 3 index = route sourcetype = reroute_3 whitelist = (host3)` At props.conf `[reroute_1] TRANSFORMS-sourcetype = overridesourcetype1 TRANSFORMS-index = overrideindex [reroute_2] TRANSFORMS-sourcetype = overridesourcetype2 TRANSFORMS-index = overrideindex [reroute_3] TRANSFORMS-sourcetype = overridesourcetype3 TRANSFORMS-index = overrideindex at transforms.conf : [overridesourcetype1] SOURCE_KEY = MetaData:Source DEST_KEY = MetaData:Sourcetype REGEX = source::\/opt\/myAPP\/\w+\/filename_(\w+).* FORMAT = sourcetype::sourcetype_$1 [overridesourcetype2] SOURCE_KEY = MetaData:Source DEST_KEY = MetaData:Sourcetype REGEX = source::\/opt\/myAPP\/\w+\/filename_(\w+).* FORMAT = sourcetype::sourcetype_$1 [overridesourcetype3] SOURCE_KEY = MetaData:Source DEST_KEY = MetaData:Sourcetype REGEX = source::\/opt\/myAPP\/\w+\/filename_(\w+).* FORMAT = sourcetype::sourcetype_$1 [overrideindex] SOURCE_KEY = MetaData:Source REGEX = source::\/opt\/myAPP\/(\w+).* DEST_KEY = MetaData:Index FORMAT = index$1` However, all the log files are indexed into the index="indexname_host3". Is there any way to route this as mentioned under 'Expected'. Kindly help... ... View more

Hi, I am planning to delete the orphan scheduled search in Splunk Clustered Search Head. is there any best way to remove it from one Search Head member to see changes in all member. Probably a Rest API good for this option, however I am not able to find one. Can anybody guide me for this. Thanks in advance. ... View more

Hi all, I have created a user which can delete splunk's native user using Rest API. However, I want to provide the minimal capability to perform such action. Currently the minimum roles I am able to provide is : admin_all_objects change_authentication dispatch_rest_to_indexers edit_roles edit_user rest_properties_get rest_properties_set schedule_rtsearch If I add role- 'power' as inheritance, it performs the user removal action. But I don't want to add 'power' as it also comes with other extra capabilities. Please help... Thanks in advance ... View more

Hi all, Is there any REST API command to add/append single or multiple roles to specific user. For e.g. user "SplunkUser" is already present in Splunk with role assigned to it as "role1". Which REST API command should be run to add roles "role2" and "role3" to User "SplunkUser". Following command I been running, but it replaces the existing role with new roles and not appending it. curl -k -u username:password <hostdetails>/services/authentication/users/SplunkUser -d roles="role2" -d roles="role3" Please help..!!! ... View more

Hi all, I have the below rest searches to fetch the User, Role and Application details, respectively. | rest /services/authentication/users | rest /services/authorization/roles | rest /services/apps/local However, am not able to define the exact read only capabilities for my role to assign, so I can run these searches to get the results. Below are the capabilities I investigated: edit_roles edit_user rest_properties_get search However, am not getting the entire application list as compared to Admin role. Also the edit_roles and edit_user are giving write permission and am looking for read permission only. Please help. ... View more

Hi all, How to form a table to display latest raw event for field mentioned by index and source type. This is the output am planning as below: The maximum I am able to reach is listing field values but not raw events containing that field. Any help is appreciated. Thanks in Advance ... View more

Hi, I am working to list all the index with underlying sourcetypes and sources in it. For which I am currently using the following command to run All Time | tstats values(source) as source where index = * by index, sourcetype The problem is that I have to run this search in the all time range, which is a heavy load and slow too. Is there any |rest command to get results in much faster or any other command where I don't have to run search with an all time duration? Thanks in advance. ... View more

Hi, I have setup one custom drill-down from Glass Table to specific Dashboard, however the dashboard loads in same tab. Is there any way we can drill-down to open the dashboard the new tab? Thanks in advance ... View more