I am aware there is an accepted answer that helped me, but the connection was not established with the message 'need further details.' However, I need to do some extra configuration to establish the connection. I followed accepted answer for jdbc driver(downloaded snowflake-jdbc-3.15.1.jar ) and to configure db_connection_types.conf ( don't copy and paste it from accpeted answer. see below db_connection_types.conf Followed below link to fix the issue: could not initialize class net.snowflake.client.jdbc.internal.apache.arrow.memory.util.MemoryUtil https://community.snowflake.com/s/article/JDBC-OutOfDirectMemoryError I added the first two options from the above solution (you can see below in case the above link is broken or removed) to the JVM Options in connection settings with a space delimiter. It didn't work. However, the connection got established with the third solution. (See db_connections.conf also to understand how that parameter is used.)   1.) Increase the maximum heap size, which in return will increase the maximum direct memory size. You will need to refer to the application's documentation for instructions on how to configure this value because it is application-specific. If you were starting the application using the java command then any of the following JVM arguments will set the maximum heap size to 1 GB: -Xmx1048576k -Xmx1024m -Xmx1g 2.) Explicitly increase the maximum direct memory size. E.g., the following JVM sets the value to 1 GB: -XX:MaxDirectMemorySize=1g 3.) If for any reason you do not have any control over the amount of memory you can allocate to your JVM (e.g., you are limited by the size of the container you're running in and it cannot be configured) then change the query result set from ARROW to JSON. You can pass this setting as a connection parameter using your JDBC driver: JDBC_QUERY_RESULT_FORMAT=JSON   Final db_connections.conf and db_connection_types.conf   local/db_connection_types.conf [snowflake] displayName = Snowflake serviceClass = com.splunk.dbx2.DefaultDBX2JDBC jdbcDriverClass = net.snowflake.client.jdbc.SnowflakeDriver jdbcUrlFormat = jdbc‌‌//:/?db= ui_default_catalog = $database$ port = 443 local/db_connections.conf [Snowflake_DB] connection_properties = {"JDBC_QUERY_RESULT_FORMAT":"JSON"} connection_type = snowflake customizedJdbcUrl = jdbc‌‌//.snowflakecomputing.com:443/?user=&db=snowflake&warehouse=&schema=public database = snowflake disabled = 0 host = .snowflakecomputing.com identity = SnowflakeUser jdbcUseSSL = false localTimezoneConversionEnabled = false port = 443 readonly = false timezone = Etc/UTC       ... View more

i'm wondering this same thing, can the schedule be modified since it's pretty resource intensive. Haven't seen a response on this thread in while.  ... View more

(Just come across this question, hence answering now, just in case anyone need help on this in the future.) There could be multiple reasons why the Add-on UI is not loading. Incorrectly configured Add-on from the backend. Missing config or spec file. Generally happens on classic Splunk Cloud instance as it removes the inputs.conf.spec and inputs.conf files. The user doesn't have admin access. If you are facing the issue on Splunk Cloud: Use IDM machine in Splunk Cloud - https://www.splunk.com/en_us/blog/platform/introducing-inputs-data-manager-on-splunk-cloud.html Go to Splunk Cloud Victoria experience, as it will allow you to run inputs on the search head.   If you are facing the issue in an On-prem environment: Make sure you have not misconfigured anything from the backend. Make sure you have all the configuration files properly as they came from Splunkbase. Also, you can run index=_internal "error", to find more details.   I hope this helps!! Karma/upvote would be appreciated!!! ... View more

I am facing similar issue with Splunk Add-on for ServiceNow version 6.4.1. Is there any fix available. ?   ... View more

facing similar issue. ... View more

Hi,   I am facing similar issue (same error), I have bunch of Universal Forwarder (version 6.5.2, 8.0.3) running in FIPS Mode. So I re-installed the UF on these linux servers.    Still I am getting the same error on my heavy forwarder running 7.2.7.    Could you please specifically mention, if I need to enable FIPS on Heavy Forwarder also. I also didn't see any document giving complete detail that where all FIPS should be enabled. If you could route me to correct document would be great.     ... View more

Splunk does not work that way but what you can do is do something like this: DC1 outputs.conf: server = DC1HF1:9997, DC2HF1:9999 DC2 outputs.conf: server = DC2HF1:9997, DC1HF1:9999 Then always run inputs.conf with port 9997 on but 9999 off. Then have cron job on both HFs that is checking on the health of his partner in the other DC and when it is down, enable the local 9999 port in inputs.conf and restart local splunk. Do the opposite when the other side comes back up. ... View more

What do you mean by limit of your nat device ? Is that the number of connections that can be generated from NAT device ? And one thing, we are not using deployment server in this model. Universal forwarders will be managed by the IT team with there own tools like SCCM/other tool. Also we wanted to know the data within the logs is still matched back to the originating log source IP of the server with the Splunk UF/ or the host IP will written as NAT IP ? ... View more

Hi, What you are doing is correct. Please find the below splunk documentation. "To find out if a license slave has been unable to reach the license master, look for an event that contains failed to transfer rows in splunkd.log or in the _internal index." Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Aboutlicenseviolations ... View more

I downvoted this post because provided suggestion is not for soap request ... View more