I have an use case where I need to run the analytics on top of data that lands into Splunk. So, I want to store all the data into S3 too as and when the data lands into Splunk. I would like to know the best possible way we have with latest version of Splunk Enterprise/Splunk Cloud platform to save copy of Splunk data into S3 as and when the data comes into Splunk. Please give suggestions on the same. Thanking you. ... View more

Hi, I want to implement a custom command in spluk. So I created an add-on using splunk add-on builder and copied code for my custom command in to add-on. While validating add-on from the add-on builder, I see  one failure (194 tests passed and one failure)  as "Detect usage of JavaScript libraries with known vulnerabilities" When I expand the error clicking on it, I see the solution column mentioned as below solution: 3rd party CORS request may execute parseHTML() executes scripts in event handlers jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Regex in its jQuery.htmlPrefilter sometimes may introduce XSS Regex in its jQuery.htmlPrefilter sometimes may introduce XSS reDOS - regular expression denial of service Regular Expression Denial of Service (ReDoS) Regular Expression Denial of Service (ReDoS) Can I get help how to resolve this javascript issue ?? Also, when I download the spl file and install the app, it is not giving "launch app" option in the manage apps page as shown in below snapshot. Is it because of installation of non-validated package?? ... View more

Hi,   I have installed splunk 8.1.8 on my linux. On login to splunk UI, I have gone through apps and installed splunk_db_connect by uploading the zip file splunk-db-connect_380.zip.    Then when I go to splunk_db_connect and setup. It is giving errors like  "cant communicate with task server, please check your settings" "str object have no attribute decode"   etc error messages in the UI. On restarting splunk and on running btool I see the below message  *************** Checking: /opt/splunk/etc/apps/splunk_app_db_connect/default/inputs.conf Invalid key in stanza [server] in /opt/splunk/etc/apps/splunk_app_db_connect/default/inputs.conf, line 2: run_only_one (value: false). Invalid key in stanza [dbxquery] in /opt/splunk/etc/apps/splunk_app_db_connect/default/inputs.conf, line 5: run_only_one (value: false). ***************   In logs, I see only one log file related to splunk_db_connect. The file name is splunk_app_db_connect_dbx.log. I cant see other files. In this log file I see below errors  ******************** 2022-02-18T06:45:18-0600 [ERROR] [settings.py], line 89 : Throwing an exception Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/rest/settings.py", line 76, in handle_POST self.validate_java_home(payload["javaHome"]) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/rest/settings.py", line 215, in validate_java_home is_valid, reason = validateJRE(java_cmd) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/jre_validator.py", line 73, in validateJRE output = output.decode('utf-8') AttributeError: 'str' object has no attribute 'decode' ************** Below is the snapshot of splunk_db_connect settings in the UI   Please help me how to resolve the issues and setup splunk DB connect succesfully.   Thanking you. ... View more

I would like to get acquainted about the Splunk UBA. I would like to know how to get the trail version of Splunk UBA. ... View more

Hi, I would like to know where can I get the test data that is being used to analyze and show information in the UI on my Splunk Enterprise Cloud sandbox trial version. Also, in other terms, I would like to know how can I load the test data to Sandbox instance such that it can be processed and results are shown in the UI. ... View more