How to cronjob the script?   because when list in cronjob, no ouput created ... View more

This is not Splunk specific issue. You can find the answer here: https://stackoverflow.com/questions/9843178/linux-capabilities-setcap-seems-to-disable-ld-library-path Generally "LD_LIBRARY_PATH=/opt/splunk/lib" get's ignored after setcap for security reasons.   Workaround is via adding Splunk libraries globally, obviously with downsides of it own   $ sudo sh -c "echo \"/opt/splunk/lib\" >> /etc/ld.so.conf.d/splunk.conf" $ sudo ldconfig     ... View more

awesome, thanks for the link ! ... View more

Not that it helps you directly, but Splunk_TA_snow 3.0 which supports Jakarta was released a few days ago. You could try a bit more arm-twisting? ... View more

I had this issue when I missed created configuration for one of the Search Head Cluster instance. I validate the configuration and checked on each Search Head if they have same Config about IDX cluster and this solves the project. ... View more