Installed new app Ansible Tower App for Splunk but am seeing error: Unable to initialize modular input "tower_app" defined inside the app "tower_app": Introspecting scheme=tower_app: script running failed (exited with code 1). Anyone else seeing "unable to initialize modular input" after install? ... View more

I have the following log and need splunk to grab the second timestamp instead of the first. I have tried adjusting props.conf as shown below as well. Task Update Application Available Targeting is due at Wednesday 03/09/2016 00:00:00 $$<SMS_DATABASE_NOTIFICATION_MONITOR><03-08-2016 19:00:26.917+00><thread=6760 (0x1A68)> Props.conf [server_log] TIME_PREFIX = >< TIME_FORMAT = %m-%d-%y %H:%M:%S. ... View more

I have a very ugly log file that I need to run a regex against and have it match as many times as possible to map the field name and the value of the field. I have a working regex that I can test through search and its working as expected but when I try to move that regex to a transforms file using REPORT, I'm not seeing any results in my searches. Here are the props.conf and transforms.conf that is running on the SH: props.conf [jamfChangeManagement] REPORT-jamfcm=jamfcm transforms.conf [jamfcm] REGEX=(<_KEY_1>.​*?)\W{5,30}(<_VAL_1>\w.*​) Any ideas why its not matching the regex in search? ... View more

I have a search that tells me when a system doesn't report into splunk after a threshold of an hour: |metadata index=vmware type=hosts | eval timenow=now() | eval lastseen=timenow-recentTime | where lastseen > 3600 | eval last_seen=tostring(lastseen, "duration") | table host last_seen Then I have a lookup csv that is driven by a dashboard that allows users to enter systems that are in maintenance mode or decommissioned. If a system hits the threshold from the first search but is listed in the csv I don't want it to fire the alert. The lookup table is called decom_maint_systems.csv. I can get the correct hostname by using set diff but the problem is I lose the "last_seen" field which I really want to keep. So how do I compare the two while keeping the fields I want from the initial search? ... View more

I have set up the Google Apps for Splunk app and successfully went through the configuration steps, but I'm not seeing any data. There are 3 inputs set up that I believe were there by default (this app was already installed when I took over this instance), but I'm wondering if they are correct or if there are other inputs that needed to be added. Any tips on getting data in? ... View more

I have a search that I can use in a dashboard that gives me statistical data about bandwidth usage on a firewall. I have a drop down that sets the location ($location$) that the user wants to query and then shows them the max mbps up and down. Here is that search: index=pan_logs sourcetype=pan_traffic src_zone=ClientVPNZone OR src_zone=trust dst_zone=Untrust $location$ | eval mbits_sec_down=(bytes_received/elapsed_time)*8/1000/1000 | eval mbits_sec_up=(bytes_sent/elapsed_time)*8/1000/1000 | timechart span=1s sum(mbits_sec_down) AS Down, sum(mbits_sec_up) AS Up | stats max(*) I would like to create a report that shows bandwidth usage per site and thought it would be as simple as adding "by host" to the end but the search doesn't show anything under the statistics tab. I'm assumed the host information isn't being sent to the last stats command so I tried adding "by host" to the timechart command but it still doesn't show results. Any ideas on how to get this report? ... View more