2024-11-01 12:25:49,065 +0000 ERROR startup:116 - Unable to read in product version information; isSessionKeyDefined=False error=__init__() got an unexpected keyword argument 'context' 2024-11-01 12:25:49,066 +0000 INFO startup:148 - Splunk appserver version=UNKNOWN_VERSION build=000 isFree=False isTrial=True productType=splunk instanceType=UNKNOWN 2024-11-01 12:25:49,066 +0000 INFO decorators:130 - loading uri: /en-US/ 2024-11-01 12:25:49,068 +0000 INFO error:342 - GET /en-US/ 127.0.0.1 8065 2024-11-01 12:25:49,068 +0000 INFO error:345 - 500 Internal Server Error The server encountered an unexpected condition which prevented it from fulfilling the request. 2024-11-01 12:25:49,068 +0000 ERROR error:346 - Traceback (most recent call last): File "/opt/splunk/lib/python3.9/site-packages/cherrypy/_cprequest.py", line 628, in respond self._do_respond(path_info) File "/opt/splunk/lib/python3.9/site-packages/cherrypy/_cprequest.py", line 687, in _do_respond response.body = self.handler() File "/opt/splunk/lib/python3.9/site-packages/cherrypy/lib/encoding.py", line 219, in __call__ self.body = self.oldhandler(*args, **kwargs) File "/opt/splunk/lib/python3.9/site-packages/splunk/appserver/mrsparkle/lib/htmlinjectiontoolfactory.py", line 78, in wrapper resp = handler(*args, **kwargs) File "/opt/splunk/lib/python3.9/site-packages/cherrypy/_cpdispatch.py", line 54, in __call__ return self.callable(*self.args, **self.kwargs) File "</opt/splunk/lib/python3.9/site-packages/decorator.py:decorator-gen-1740>", line 2, in index File "/opt/splunk/lib/python3.9/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 52, in rundecs return fn(*a, **kw) File "</opt/splunk/lib/python3.9/site-packages/decorator.py:decorator-gen-1738>", line 2, in index File "/opt/splunk/lib/python3.9/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 134, in check return fn(self, *a, **kw) File "</opt/splunk/lib/python3.9/site-packages/decorator.py:decorator-gen-1737>", line 2, in index File "/opt/splunk/lib/python3.9/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 185, in validate_ip return fn(self, *a, **kw) File "</opt/splunk/lib/python3.9/site-packages/decorator.py:decorator-gen-1736>", line 2, in index File "/opt/splunk/lib/python3.9/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 264, in preform_sso_check update_session_user(sessionKey, remote_user) File "/opt/splunk/lib/python3.9/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 207, in update_session_user en = splunk.entity.getEntity('authentication/users', user, sessionKey=sessionKey) File "/opt/splunk/lib/python3.9/site-packages/splunk/entity.py", line 276, in getEntity serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "/opt/splunk/lib/python3.9/site-packages/splunk/rest/__init__.py", line 573, in simpleRequest h = httplib2.Http(timeout=timeout, proxy_info=None, context=ctx) TypeError: __init__() got an unexpected keyword argument 'context' ... View more

Hi, How to add MSAL4J.jar to DB_Connect. I am getting error: Failed to load MSAL4J Java library for performing ActiveDirectoryServicePrincipal authentication. ... View more

Hi, How to create automatic tag if: eventtypes.conf [duo_authentication] search = sourcetype=json:duo type=authentication tags.conf [eventtype=duo_authentication] authentication = enabled I also add to admin, user, power roles "default: index=index_of_duo". But, simply it want add tag (dont understand why if above eventtype search is working) ... View more

Hi, if we upgrade license to 500GB. What is best practice Hardware architecture (CPU +RAM) based and number of "N" Search Heads, "N" indexers. How much storage per indexer we need if let's say retention is 30 days and "N" installed indexers. or if at least you can share where is good .pdf for me to read with those answers. Thank you. ... View more

what's the fastest way to import into KVStore? I have about 650 000 rows and import is slow over "Lookup File Editig" app. Import last Approx. few hours. Is there any faster way to import into KVStore. Or do I create new dummy index and then I import into index (will that be faster) ... View more

Hi, There is a need to send automated summary of daily emails that are stopped by anti-spam filter. In Splunk we have act=quarantined and we can see all stopped emails, but how to create "one alert or report" for specific users where they get on Email only results where their Email is matched.  Example. If I do something like this             index="email" act="QUARANTINED" | lookup email_notify_quarantine email AS orig_recipient OUTPUTNEW notify AS notify | where notify="true" ...             I'll get results for Quarantined messages for all user's that need to get that report and now If I create Scheduled Report or Alert I am afraid that user will get all list of Quarantined messages not only theirs. ... View more

Hi, Just curios if this is possible as I have interesting challenge. So, I have extracted fields, key=value id0=0000, id1=1111, id2=2222,inN=NNNN,zone0=zone0,zone1=zone1,zone2=zone2,zoneN=zoneN Now I want to create new field that is like this just number AutoIncrements | eval example0 = id0 + " location:" + zone0 My challenge is, how to make that more "automatic" as I don't know the number "N" in event and want to automate this new field so for every exampleN i have the same eval example. I mean it'll be a little more complicated as I'll create some case statement in eval but inital challange is how to automate it on simpler just string scenario. ... View more