After upgrading to Splunk v9.4.12 was able to fix the issue by adding on server.conf [applicationsManagement] allowInternetAccess = false ... View more

Applied the suggested fix on Splunk 9.3.9, it only converted ERROR LocalAppsAdminHandler [846555 TcpChannelThread] - Failed to fetch and parse apps dump; aborting splunkbase apps cache update ERROR LocalAppsAdminHandler [846555 TcpChannelThread] - Failed to fetch apps from apps dump error at url=https://cdn.splunkbase.splunk.com/public/report/apps_dump.json code=502 desc=Error connecting: Connect Timeout To (every time I click on the GUI now) ERROR LocalAppsAdminHandler [1078631 TcpChannelThread] - Failed to parse apps dump uri from server.conf; aborting splunkbase apps cache update Do you had the same issue? ... View more

Known issue for version 9.2 After upgrading to 9.2 ERROR UserManagerPro - user="nobody" had no roles message started to appear | Splunk ... View more

Looks like a known issue for version 9.2 After upgrading to 9.2 ERROR UserManagerPro - user="nobody" had no roles message started to appear | Splunk ... View more

Try something like: ... search="| savedsearch 'This is a test report'".... Or the other way around: ... search='| savedsearch "This is a test resport"' ... One of those should work. ... View more

This solution is incorrect or outdated for recent versions of Splunk, as earliest and latest values are not calculating 2nd Tuesday of specified months correctly. ... View more

After upgrading the app, the error still occurs. The decrypt command only works if at the end of a Splunk query. If I run now sendemail after the decrypt I get: External search command 'sendemail' returned error code 1. . If I run any stats it just show no results found. ... View more

Decrypt v2.3.0 works fine with my Splunk v8.1.1 infra if I execute it at the end of a Splunk query. If I run any command, like table or sendemail, after the decrypt command it fails with same error message. Alert from saved search with decrypt command is not sent as well. Could you please clarify. ... View more

@k_harini Just install Python version 2.7.x instead of Python version 3.x. ... View more

Ok but idk cause I don't has that kind of error since I execute my SP's like you said the first time, EXEC user.sp_name And if you need to pass variables to them it's EXEC user.sp_name @VARIABLE = value Try that, it could be your solution. ... View more

You need to delete the SELECT * FROM and the t at the end. I think that it's supposed to remain only the %s which is the query. ... View more

Thanks @jcoates 🙂 ... View more

@jcoates how do you disable query wrapping on connection?? ... View more

I run two SP's in SQL with DB Con v1 and they work but I can't run them in DB Con v2. Try DB Con v1, they will probably work. Just do EXEC stored_proc_name ... View more

I run two SP's in SQL with DB Con v1 and they work so probably those work too. Just do EXEC stored_proc_name ... View more

But that doesn't solve the problem, because in DB con v1 i used {{ AND $rising_column$ > ? }} in the middle of my query and now i can't do that in DB con v2. That's not a good solution, since it adds a WHERE at the end of the query when i want to use you explicitly $rising_column$ > ? in the middle of it. ... View more

I'm running two SP's almost for an year in Splunk DB Connect v1. I also have two Data Inputs running daily (which are calling those SP's from a SQL DB) to populate two different indexes. And I never had problems. How is this possible? Since it's not supported? For example in DB con v1 I run: EXEC sp_help and it works. In DB con v2.2 I run: EXEC sp_help, at step 2 of 4, and it gives error, " External search command 'dbxquery' returned error code 1. Script output = RuntimeError: Failed to run query: "SELECT * FROM (EXEC sp_help) t", caused by: AvroRemoteException(u"java.sql.SQLException: Incorrect syntax near the keyword 'EXEC'.",). " ... View more

I'm running two SP's almost for an year in Splunk DB Connect v1. I also have two Data Inputs running daily (which are calling those SP's from a SQL DB) to populate two different indexes. And I never had problems. How is this possible? Since it's not supported? ... View more

Hey @laurie_gellatly can you put here how you run the stored procedure from the GUI please? Cause I'm trying to run one SP but it always gives me error at EXEC. Regards ... View more

Yeah I think that's the problem too Dave. Thanks ... View more