Hi, when we try to create a dblookup, based up DB Connect v2, out of a tableview from an Oracle DB with 33 million entries we always get the following error message, after we execute a splunk query that uses the lookup: 09-14-2016 14:59:05.855 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py bic_testlookup': Traceback (most recent call last): 09-14-2016 14:59:05.855 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py bic_testlookup': File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py", line 114, in <module> 09-14-2016 14:59:05.855 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py bic_testlookup': raise ex 09-14-2016 14:59:05.855 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py bic_testlookup': RuntimeError: maximum recursion depth exceeded 09-14-2016 14:59:05.867 ERROR LookupOperator - Script for lookup table 'db_connect_bic_testlookup' returned error code 1. Results may be incorrect. With DB Connect v1 our lookup definition with the exact same database worked perfectly fine. What has been changed in v2 and how can we fix it to make it work again? Thank you in advance. ... View more

Hi, We always run into the problem where people leave our organization, we delete their account in Splunk, but want to keep their automated reports and dashboards. Is there a smart solution to move one app/dashboard/scheduled search/field/whateverelement to a new owner? Thank you in advance, Tom ... View more

Hello, I am currently trying to make Damien's Kafka Modular Input run on a Splunk Universal Forwarder 6.2.3 under RedHat 6. Unfortunately i am getting the following errors in the splunkd.log: 06-02-2015 09:33:38.282 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder". 06-02-2015 09:33:38.282 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" SLF4J: Defaulting to no-operation (NOP) logger implementation 06-02-2015 09:33:38.282 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details. We are running Python 2.6 on the host. Recommended is Python 2.7 version. Could this be the root cause? Here is our inputs.conf: # Kafka Data Inputs {{{ [kafka://kafka-hostname] additional_consumer_properties = group.id=7 auto_commit_interval_ms = 1000 group_id = 6 index = test sourcetype = kafka-test topic_name = logstash zookeeper_connect_host = zoo-hostname1,zoo-hostname2,zoo-hostname3,zoo-hostname4,zoo-hostname5 zookeeper_connect_port = 2181 zookeeper_session_timeout_ms = 400 zookeeper_sync_time_ms = 200 disabled = false # }}} When i use only one zoo-host and leave the following lines out: additional_consumer_properties = group.id=7 auto_commit_interval_ms = 1000 group_id = 6 i get different error messages in the splunkd.log: 06-02-2015 11:06:15.242 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.consumer.ZookeeperConsumerConnector.kafka$consumer$ZookeeperConsumerConnector$$registerConsumerInZK(ZookeeperConsumerConnector.scala:226) 06-02-2015 11:06:15.242 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.consumer.ZookeeperConsumerConnector.consume(ZookeeperConsumerConnector.scala:211) 06-02-2015 11:06:15.242 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.javaapi.consumer.ZookeeperConsumerConnector.createMessageStreams(ZookeeperConsumerConnector.scala:80) 06-02-2015 11:06:15.242 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.javaapi.consumer.ZookeeperConsumerConnector.createMessageStreams(ZookeeperConsumerConnector.scala:92) 06-02-2015 11:06:15.243 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at com.splunk.modinput.kafka.KafkaModularInput$MessageReceiver.run(Unknown Source) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" Stanza kafka://kafka-dev-290687.lhotse.ov.otto.de : Error running message receiver : java.lang.IllegalArgumentException: Invalid path string "/consumers//ids/_kafka-dev-290687-1433235975245-76b9eb2e" caused by empty node name specified @11 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.apache.zookeeper.common.PathUtils.validatePath(PathUtils.java:99) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.apache.zookeeper.common.PathUtils.validatePath(PathUtils.java:35) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.apache.zookeeper.ZooKeeper.create(ZooKeeper.java:626) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkConnection.create(ZkConnection.java:87) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient$1.call(ZkClient.java:308) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient$1.call(ZkClient.java:304) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient.retryUntilConnected(ZkClient.java:675) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient.create(ZkClient.java:304) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient.createEphemeral(ZkClient.java:328) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.utils.ZkUtils$.createEphemeralPath(ZkUtils.scala:253) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.utils.ZkUtils$.createEphemeralPathExpectConflict(ZkUtils.scala:268) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.utils.ZkUtils$.createEphemeralPathExpectConflictHandleZKBug(ZkUtils.scala:306) What am i doing wrong in my configuration? Please help. ... View more

Hello, we want to calculate some Requesttimes vs. Requestnumbers. What we do is source=ourdata.log | timechart span=1h sum(duration) as impact count(ws-method) by domain Now we want to search in the same log for source=ourdata.log | stats (count) ws-method="thespecialmessage" With the results from the second search, we want to divide the results from the first query. how can we do that? This seems to be a multidimensional search... ... View more