Yes, I used this query: | rest /services/apps/local splunk_server=* | search disabled=0 core=0 | fields title label version splunk_server | stats values(title) as title, values(label) as label, values(version) as version, by splunk_server disabled=0 is only listing the apps that are enabled (in use) core=0 is only listing the apps that are not Splunk core apps (part of the install pkg) ... View more

what if I installed just JRE and not JDK ? ... View more

Hello, Did you find an answer to this question? I am faced with a similar situation.   ... View more

Attempting to bring this current.  For Splunk cloud: customers: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Admin/DataSelfStorage For Splunk enterprise with SmartStore(s3): https://docs.splunk.com/Documentation/Splunk/8.1.3/Indexer/SmartStorearchitecture https://aws.amazon.com/blogs/aws/archive-s3-to-glacier/ For Splunk enterprise without smartstore: No similar feature found.  Build your own as previously mentioned. see also (https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-put-cold-and-frozen-data-on-s3-in-AWS/) ... View more

"All non Internal Indexes" = All indexes but NOT _* indexes "All Internal Indexes" = All _* indexes (splunks own indexes) user3 should have access too index A ... View more

Looking at the error: License Manager: Failed to contact license master: reason='Unable to connect to license master: https://xxx.com:8089 Connect to=https://xxx.com:8089 C timed out; exceeded 30sec', first failure time=1526522560 (Wed May 16 22:02:40 2018 EDT). You could increase the connection timeouts for the license server in server.conf: http://docs.splunk.com/Documentation/Splunk/7.1.0/Admin/Serverconf ... View more

ok then try this in props.conf: [sourcetypename] TRANSFORMS-null= setnull in transforms.conf [setnull] REGEX =(?i)Committing\sall\stransactions\susing\s\(.*\)\stransaction\smanager DEST_KEY = queue FORMAT = nullQueue try this and if it works then add remaining regex... after making changes restart forwarder ... View more

Hi @rdagan, When I run any job on the Hadoop server it works fine without any issues. However it fails on the splunk Analytics for Hadoop Server. I'm quite confused with the kerberos settings in indexes.conf for which I might need some help here: I have splunkd1@TS.fitco.com Principal on the splunk analytics node and splunkd1@RT.rtp.com principal on hadoop cluster. Both these two different accounts with diff passwords. I was able to run a mapreduce job on the Hadoop cluster using splunkd1@RT.rtp.com user account. I generated keytab file (splunkd1.keytab) for splunkd1@RT.rtp.com on the Splunk node - at /home/splunkd1/ and updated indexes.conf with the same as below: vix.kerberos.keytab = /home/splunkd1/splunkd1.keytab vix.kerberos.principal = splunkd1@RT.rtp.com Are the steps that I've followed incorrect or correct?? Kindly help. ... View more

Yes, Normally people install Hadoop Client Binary and Hadoop Client Configs on the Splunk Search Head. In many cases you can use Cloudera Manager, or you can just install Hadoop using these simple steps: http://hadoop.apache.org/docs/r2.7.4/ In your configurations I see that the Hadoop Home seems wrong. vix.env.HADOOP_HOME = /user/splunkdev looks like you are pointing to Splunk binaries not Hadoop Binaries. ... View more

Hi @rdagan , I have splunkd1@TS.fitco.com user on the splunk node and splunkd1@RT.rtp.com user on hadoop cluster. I have created keytabfile for splunkd1@TS.fitco.com and provided in the indexes.conf....and I get this error while executing hadoop commands on splunk host. ls: Failed on local exception: java.io.IOException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]; Host Details : local host is: "splunkdev@TS.company2.COM/xx.xx.xx.xxx"; destination host is: "SLPP02.HADOOP.company.COM:8020; [hadoopidx] coldPath = $SPLUNK_DB/hadoopidx/colddb enableDataIntegrityControl = 0 enableTsidxReduction = 0 homePath = $SPLUNK_DB/hadoopidx/db maxTotalDataSizeMB = 20480 thawedPath = $SPLUNK_DB/hadoopidx/thaweddb [provider:eihadoop] vix.command.arg.3 = $SPLUNK_HOME/bin/jars/SplunkMR-hy2.jar vix.dfs.namenode.kerberos.principal = hdfs/_HOST@HADOOP.company.COM vix.env.HADOOP_HOME = /opt/local/hadoop-2.6.0-cdh5.9.1 vix.env.HUNK_THIRDPARTY_JARS = $SPLUNK_HOME/bin/jars/thirdparty/common/avro-1.7.7.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/avro-mapred-1.7.7.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/commons-compress-1.10.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/commons-io-2.4.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/libfb303-0.9.2.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/parquet-hive-bundle-1.6.0.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/snappy-java-1.1.1.7.jar,$SPLUNK_HOME/bin/jars/thirdparty/hive_1_2/hive-exec-1.2.1.jar,$SPLUNK_HOME/bin/jars/thirdparty/hive_1_2/hive-metastore-1.2.1.jar,$SPLUNK_HOME/bin/jars/thirdparty/hive_1_2/hive-serde-1.2.1.jar vix.env.JAVA_HOME = /usr/java/jdk1.8.0_102 vix.family = hadoop vix.fs.default.name = hdfs://SLPP02.HADOOP.company.COM:8020 vix.hadoop.security.authentication = kerberos vix.hadoop.security.authorization = 1 vix.javaprops.java.security.krb5.kdc = SLP013.HADOOP.company.COM vix.javaprops.java.security.krb5.realm = HADOOP.company.COM vix.mapreduce.framework.name = yarn vix.output.buckets.max.network.bandwidth = 0 vix.splunk.home.hdfs = /user/splunkdev/hadoopanalytics/ vix.yarn.nodemanager.principal = yarn/_HOST@HADOOP.company.COM vix.yarn.resourcemanager.address = https://SLPP08.HADOOP.company.COM:8090/cluster vix.yarn.resourcemanager.principal = yarn/_HOST@HADOOP.company.COM vix.yarn.resourcemanager.scheduler.address = https://SLPP015.HADOOP.company.COM:8090/cluster/scheduler vix.mapreduce.jobtracker.kerberos.principal = mapred/_HOST@HADOOP.company.COM vix.kerberos.keytab = /home/splunkd1/splunkd1.keytab vix.kerberos.principal = splunkdev@TS.company2.COM [splunk_index_archive] vix.output.buckets.from.indexes = hadoopidx vix.output.buckets.older.than = 172800 vix.output.buckets.path = /user/splunkdev/splunk_index_archive vix.provider = eihadoop ... View more

Hi sarnagar, the option must be inserted in the Panel options of the dashboard, not in the search. Anyway I see that the results of your search are limited to 10. Bye. Giuseppe ... View more

HI @somesoni2, When I export the results I dont get all the folders for the host. Only the first folder for any host is present. Why does this happen? KindLy help. ... View more

Thnakyou @ kamlesh_vaghela , that helped. ... View more

Hi @samagar like this \/opt\/[^\/]+?\/logs\/(?<myfield>\w+?)(?:\/|\.) ... View more

If there is an available JMS provider for Kafka , then yes , google "kafka jms provider". But you'd be better to use my Kafka App , https://splunkbase.splunk.com/app/1817/ ... View more

Hi sarnagar, there isn't any duplications: if you address twice the same file, it will be indexed only one time. You must take care when you have duplicated inputs if you set different indexes or sourcetypes because the log will be read only one time and assigned only to one index or sourcetype. Bye. Giuseppe ... View more

my understanding is that a dbxoutput needs to specify an output. How does the SH know about the output delcared on the HF? In my environment, I have created an output (with and without scheduling enabled) on the SHC and this works but is it supported? Also as a test, I see in the SH log that the output gets scheduled but it appears that it never really gets executed. Is this the expected behaviour or should the UI present an error when saving a scheduled output (i noticed the yellow warning about some functions won't work)? ... View more

Hey @saranya_fmr - You're going to spend more time reinventing the wheel than just getting the DMC set up. I'll email you so we can get that going as it will be immensely more valuable and sooo easy to accomplish. Spoiler Alert: http://docs.splunk.com/Documentation/Splunk/latest/DMC/Deploymentsetupsteps ... View more

Ohhh...Let me try to resolve it first then..Thankyou for the info... Also it would be great if you could help me on thsi issue as well 😞 https://answers.splunk.com/answers/482063/splunk-add-on-for-kafka-jmxlog-how-to-resolve-jmx.html ... View more

Hi sarnagar, I'm using a cluster of Heavy Forwarders as HEC endpoints and I'm controlling it from master. I set my Heavy Forwarder to be a deployment client and I distribute HEC token from master to all of them !! ... View more

Hi sarnagar! Did you get something on the question? I've faced the same question. And even more: is it possible to push data back from Splunk to Kafka? (i.e. to another system via Kafka) ... View more

Hi @rdagan , That was really informative. Thankyou so much for your help..!! 🙂 ... View more

This blog was really informative..Thanks a lot..!! @rdagan 🙂 ... View more

Hi sarnagar, I'm not sure that this regex takes all your situations, every way it extract the field you asked. Try this \{\"([^\"]*\"){9}(?<image>.*)\/(?<service>Actionate[^\"]*)\/(?<id>.*)\"\} see it at https://regex101.com/r/2mhZ25/1 Generally, you can test your regexes at https://regex101.com/ Bye. Giuseppe ... View more

You can extract the fields so that they show up in Interesting Fields, and use those fields directly in searches, but you cannot change how they display in the UI with config changes without using SEDCMD. ... View more