Hi, I'm getting this message from save_container(): "Container addition failed, reason from server: Asset myasset (7) does not support ingestion." I've added all roles and users in the asset settings (including automation) but it still fails with the same error How do I enable the ingestion? Thanks PS: This is Splunk Phantom version 4.9.34514, there is no "Ingest Settings" tab as mentioned in https://docs.splunk.com/Documentation/Phantom/4.9/Admin/AppsAssets ... View more

12-08-2020 21:54:50.912 +0000 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/bitglass/bin/logeventdaemon.py" /opt/splunk/bin/python3.7: can't open file '/opt/splunk/etc/apps/bitglass/bin/logeventdaemon.py': [Errno 2] No such file or directory host=idx-i-03...c2.customer.splunkcloud.com    source=/opt/splunk/var/log/splunk/splunkd.log    sourcetype=splunkd   The customer has installed from the cloud-certified .spl app. The file path is valid according to the customer.. Any hints appreciated Thanks ... View more

Hi, I have an app which collects logs and I have configured it to send data to a local enterprise instance of splunk and splunk cloud, I can see the data in the local enterprise instance but not in the cloud instances I do see the following which shows connection has been established   11-09-2020 10:19:08.710 +0000 INFO Metrics - group=tcpin_connections, ingest_pipe=0, 73.202.128.135:57829:9997, connectionType=cookedSSL, sourcePort=57829, sourceHost=3.202.128.13, sourceIp=3.202.128.13, destPort=9997, kb=0.326171875, _tcp_Bps=10.774122169132621, _tcp_KBps=0.010521603680793575, _tcp_avg_thruput=0.011187444180915055, _tcp_Kprocessed=10.939453125, _tcp_eps=0.03225785080578629, _process_time_ms=0, evt_misc_kBps=0, evt_raw_kBps=0, evt_fields_kBps=0, evt_fn_kBps=0, evt_fv_kBps=0, evt_fn_str_kBps=0, evt_fn_meta_dyn_kBps=0, evt_fn_meta_predef_kBps=0, evt_fn_meta_str_kBps=0, evt_fv_num_kBps=0, evt_fv_str_kBps=0, evt_fv_predef_kBps=0, evt_fv_offlen_kBps=0, evt_fv_fp_kBps=0, build=a6754d8441bf, version=8.0.3, os=Linux, arch=x86_64, hostname=splunkforwarder, guid=8ECC1FB9-30F3-4F5E-AB9A-9668E6BCCDDD, fwdType=full, ssl=true, lastIndexer=107.22.176.26:9997, ack=false root@splunkforwarder:/home/linux# /opt/splunk/bin/splunk search 'index=_internal source=*metrics.log* destHost | dedup destHost' Splunk username: splunk Password: 11-09-2020 10:14:48.227 +0000 INFO StatusMgr - destHost=prd-p-f4rpr.splunkcloud.com, destIp=107.22.176.26, destPort=9997, eventType=connect_fail, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor 11-09-2020 10:02:51.476 +0000 INFO StatusMgr - destHost=inputs.prd-p-f4rpr.splunkcloud.com, destIp=107.22.176.26, destPort=9997, eventType=connect_done, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor 11-09-2020 10:02:21.773 +0000 INFO StatusMgr - destHost=192.168.5.131, destIp=192.168.5.131, destPort=9997, eventType=connect_done, publisher=tcpout, sourcePort=8089, statusee=TcpOutputProcessor root@splunkforwarder:/home/linux# ... View more

Hi, I'm looking for some insight into the trade offs (if any) in using stdout vs. the  '/services/receivers/simple?' REST API for scripted input. In particular in relation to different deployment options (such as a separate forwarder etc.) Thanks   ... View more

Hi, I'm getting the following error message from the splunk python code in admin.py (the trace is below in bold) every time my input script gets called. Despite the recurrent error the input script gets all the data imported successfully. I've checked inputs.conf many times and tried different parameters according to the spec to see if it made any difference but no. There are no errors in the script itself. There is no impact on the app functionality but this error pollutes the log which is the issue I'm trying to solve. Any clues what could trigger this? Thanks   File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 137, in init     mode = ((len(sys.argv) > 1) and sys.argv[1] in ARGS_LIST) and sys.argv[1] or usage()   File "/opt/splunk/lib/python3.7/site-packages/splunk/admin.py", line 16, in usage     raise UsageException("Usage: %s [%s].  (Got: %s)" % (sys.argv[0], str.join(str(" | "), ARGS_LIST), sys.argv)) splunk.admin.UsageException: Usage: /opt/splunk/etc/apps/myapp/bin/myscript.py [setup | execute | persistent].  (Got: ['/opt/splunk/etc/apps/myapp/bin/myscript.py'])   ... View more