Hello everyone, I am trying to configure Splunk DB connect app, and getting next one error in logs: 2023-01-12T14:46:28+0300 [ERROR] [settings.py], line 89 : Throwing an exception Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/rest/settings.py", line 76, in handle_POST self.validate_java_home(payload["javaHome"]) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/rest/settings.py", line 220, in validate_java_home raise Exception(reason) Exception: PermissionError: [Errno 13] Permission denied: '/usr/java/jdk1.8.0_311-amd64/bin/java' validate java command: /usr/java/jdk1.8.0_311-amd64/bin/java.   Folders /usr/java/jdk1.8.0_311-amd64 has owner splunk -  drwxr-xr-x. 9 splunk splunk 107 Jan 12 12:54 jdk1.8.0_311-amd64 Folder /opt/splunk/etc/apps/splunk_app_db_connect has owner splunk too - drwx------. 18 root root 4096 Jan 12 13:44 splunk_app_db_connect   My splunk is working from user splunk grep SPLUNK_OS_USER= /opt/splunkforwarder/etc/splunk-launch.conf SPLUNK_OS_USER=splunk   What is the reason, can anyone help? ... View more

Hello, everyone I've "all-in-one" splunk installation, configured syslog input, but input messages are rejected. Below messages from splunkd.log 12-21-2022 09:24:24.966 +0300 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1009858353 bytes from src=*:60020 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. 12-21-2022 09:24:24.969 +0300 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1009987646 bytes from src=*:60032 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. 12-21-2022 09:24:24.975 +0300 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1009858353 bytes from src=*:60034 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. 12-21-2022 09:24:31.739 +0300 ERROR TcpInputProc - Message rejected. Received unexpected message of size=1009858353 bytes from src=*:49684 in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload.   Tried to increase queueSize in inputs.conf, but without success result ... View more

Hello everyone! I have basic search index=main | stats list(src.port), list(dst.port) count(src.ip) as COUNT by id How can I apply mvdedup (or stats dc, don't know how better) to field dst.port only if numbers of dst ports = field COUNT? ... View more

Hello everyone! What is the best way to remove dots from domain in field? for example | eval field = lower(mvindex(split(field, "."), 0)) removes just 1 dot, and what if 2+ dots in domain? ... View more

Hello, everyone! I have few questions about indexers cleaning: - How it's performed in clustered architecture? - Does it really needed? Do I correctly understand that frozen buckets delete automatically? ... View more

Hello everyone, I am trying to install forwarder on Linux chown -R splunk:splunk /opt/splunkforwarder sudo -u splunk sh -c "/opt/splunkforwarder/bin/splunk set deploy-poll deployment_address:8089"   and getting error: sh: /opt/splunkforwarder/bin/splunk: Permission denied   What should I look? What can be problem? ... View more

Hello everyone! I have 2 lookups - 1.csv and 2.csv 1.csv contains such table host user result host1 Alex success host2 Michael fail   2.csv host action host1 action1 host2 action2   I want to make search that will join this two tables in one by field host (but only in search, without changing csv content). It should turn out like this host user result action host1 Alex success action1 host2 Michael fail action   so if there is similar host in two tables - join them in one thank you for your help ... View more

Hello everyone! I have time in such format 2022-09-02T18:44:15, this time in GMT+3, and I need to change convert this time to UTC. Can you help me?  ... View more