@robjackson - Yes you can write the queries with WITH statement. Color highlighting - It is just that DB Connect is not as smart about SQL queries as Splunk to SPL queries but because DB Connect uses JDBC connector if you have the right drivers installed it should be able to run any correct SQL query. (I even had a scenario where DB connect was not allowing me to save a SQL query from the inputs page, but I was able to configure the same query from the db_inputs.conf file from the backend.) So, yes it should run any correct SQL query.   I hope this helps!!! ... View more

@discenzadoe - register from here to join us on Slack - splk.it/slack  ... View more

Bumping this thread as this is very useful information that does not seem to have a lot of documentation surrounding it. ... View more

He asked for the other way. Archer data to Splunk. Not Splunk to Archer ... View more

Sorry thought that was included. Technology Inventory Add-on for Splunk https://splunkbase.splunk.com/app/3032/ ... View more

Ok refer to my previous answer with stats and you might not need to increase the memory limit as mvexpand need memory. ( up to you to try as your issue is already resolved) 😉 ... View more

I am getting the same exception, any idea how we can resolve this. ... View more

We have the same issue. and change the start date to get it working. We also have the same issue with IP360 data being collected with DBConnect. ... View more

I have done the following: Created basic APP framework through the WEB-GUI on a standalone Search Head. Then found found the APP files which the GUI created here: /apps/splunk/etc/apps/myapp Tar up that directory: cd /apps/splunk/etc/apps; tar cvf myapp.tar myapp Transfer and untar myapp.tar to your search head deployer to this directory /apps/splunk/etc/shcluster/apps. Once you have /apps/splunk/etc/shcluster/apps/myapps on your deployer, then run "shcluster-apply stage" and "shcluster-apply send" to update your search head cluster. I found if I tried to create through the Search Head Cluster WEB-GUI, the updates are not replicated properly between the cluster nodes. I'm guessing this is the manual method as mentioned above. I've haven't yet found a more efficient way to do this. ... View more

@ajhstn same as above. you have to open up those macros and run each section, pipe by pipe to see why it's not running in your system. there is something silently failing. You have to reveal what it might be that is unique to your config... ... View more

Also, if you have a object with the same name you will get this error. Like a report and alert with the same name. ... View more