The dll solution did not work for me. I'm still facing the issue. ... View more

Anyone who comes across this issue please upvote the following idea for a configuration option to disable INDEXED_EXTRACTIONS via an app's local props.conf.   https://ideas.splunk.com/ideas/EID-I-2400 ... View more

Here is what I found. When using that connection type we needed to add an option authenticationScheme=NTLM (which enables NTLMv2 authentication) and then in our environment we made sure SSL is enabled (encrypt=true) and added the option trustServerCertificate=true. After that, the connection could be saved and worked fine.  ... View more

I use a workaround. Background of what I did: I am writing a bash script, to create Splunk diag using splunk user and move the diag file to the desired folder of mine. [root@myserver ~]# vi test_script.sh sudo -i -u splunk bash << EOF # Create Splunk Diagnostic Report /opt/splunk/bin/splunk diag > /opt/splunk/mylog.log EOF # Use grep to extract the path from the output diag_path=$(cat /opt/splunk/mylog.log | grep -oP '(?<=Splunk diagnosis file created: )/.*\.tar\.gz') echo $diag_path # Check if the path is not empty if [ -n "$diag_path" ]; then      # Copy the file to /root/mydesiredfolder      mv "$diag_path" /root/mydesiredfolder      echo "File copied successfully to /root/mydesiredfolder" else      echo "Path not found or command did not generate the expected output" fi # Cleanup rm /opt/splunk/mylog.log ########## The idea behind it is when running ./splunk diag, it will have the output of something like this Splunk diagnosis file created: /opt/splunk/diag-servername-2023-12-22_08-19-01.tar.gz ... View more

For the sake of anyone searching and finding this, these return a float that matches time picker when I try them. I just wish I could find inheritable or nested Option() types so I can borrow those with their existing validation. earliest = self.search_results_info.api_et latest = self.search_results_info.api_lt ... View more

From what I can tell, these look like the right attributes. They show up with a float so you may have to convert them depending on what you're using it for. earliest = self.search_results_info.api_et latest = self.search_results_info.api_lt I'd like to know how to create an Option() that uses the same validator as what search uses.  LMK if you find that. ... View more

Can someone explain how to handle the \" characters in a capture group when my field boundaries are double quotes? That's what I really need. It seems like splunk is having a problem when I escape the backslash and double quotes in my regex. Other regex tools are able to handle things like \"(?(\\"|[^\"])?)\" or \"(?(?:(\\"|[^\"]))?)\" just fine... but splunk errors on it. ... View more