Hi Team,   We have recently installed OCI add-on in splunk heavy forwarder to collect the OCI log's from oracel cloud instances. after insalling and configuring the OCI input's we are getting below error's. can you please help us with the resolution.   12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" oci._vendor.requests.exceptions.SSLError: (MaxRetryError("OCIConnectionPool(host='cell-1.streaming.XX.XX.XX.oci.oraclecloud.com', port=443): Max retries exceeded with url: /20180418/streams/XX.XX.XX/groupCursors (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1106)')))"), 'Request Endpoint: POST https://XX.XX.XX/groupCursors See https://docs.oracle.com/en-us/iaas/Content/API/Concepts/sdk_troubleshooting.htm for help troubleshooting this error, or contact support and provide this full error message.') 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" During handling of the above exception, another exception occurred: 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" Traceback (most recent call last): 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" File "/apps/splunk/etc/apps/TA-oci-logging-addon/bin/multiprocess/pool.py", line 121, in worker 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" result = (True, func(*args, **kwds)) 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" File "/apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py", line 102, in get_messages 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" cursor = get_cursor_by_group(global_stream_clients[i], stream_id, stream_id, opt_partition) 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" File "/apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py", line 59, in get_cursor_by_group 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" response = sc.create_group_cursor(sid, cursor_details) 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" File "/apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci/streaming/stream_client.py", line 505, in create_group_cursor 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" api_reference_link=api_reference_link) 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" File "/apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci/retry/retry.py", line 308, in make_retrying_call 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" response = func_ref(*func_args, **func_kwargs) 12-19-2024 14:20:13.722 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" File "/apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci/base_client.py", line 485, in call_api 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" response = self.request(request, allow_control_chars, operation_name, api_reference_link) 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" File "/apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci/base_client.py", line 606, in request 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" raise exceptions.RequestException(e) 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" """ 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" The above exception was the direct cause of the following exception: 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" Traceback (most recent call last): 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" File "/apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py", line 510, in stream_events 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" get_response = r.get() 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" File "/apps/splunk/etc/apps/TA-oci-logging-addon/bin/multiprocess/pool.py", line 657, in get 12-19-2024 14:20:13.723 +0000 ERROR ExecProcessor [30077 ExecProcessor] - message from "/apps/splunk/bin/python3.7 /apps/splunk/etc/apps/TA-oci-logging-addon/bin/oci_logging.py" raise self._value ... View more

HI all i have prepared splunk search query for every day  poolwise license  but i need  last 6 months poolwise data and it is for every day from last 6 months onwords    query for daily license check for poolwise |rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval Used=round(used_bytes/1024/1024/1024, 3) | eval Quota=round(quota/1024/1024/1024, 3)| fields Pool Used Quota| eval PercentageUsed=Used*100/Quota|fields Pool Used Quota PercentageUsed|eval PercentageUsed = PercentageUsed + " %"   Result: Pool Used Quota PercentageUsed auto_generated_pool_enterprise 0.000 0.211 0.00 % Development 15.684 29.297 53.534 % Linux Operations 1.586 8.789 18.05 % Networks Logs 0.801 2.441 32.8 % Production 41.616 94.238 44.161 %   This query is for daily basis and it will  provide the day wise license can you please help me with the query for last 6 months  everyday how much license is consumed    ... View more

splunk@:~/bin $ systemctl status splunk ● splunkd.service - Splunk Universal Forwarder Loaded: loaded (/etc/systemd/system/splunkd.service; enabled; vendor preset: disabled) Active: failed (Result: protocol) since Tue 2021-04-20 11:49:25 UTC; 2h 41min ago Process: 1869 ExecStart=/opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt (code=exited, status=0/SUCCESS) Main PID: 2050 (code=exited, status=0/SUCCESS) When i run the comand (systemctl status splunk) it will come like this i have kill the process and  and  restarted the splunk farwarder and its running now and i have removed the  all old PIDs. can you please tell me how to resolve this issue.  ... View more

i am receiving the splunk alerts from the mail  after that when i click on the "view result"  i am getting this error "The search you requested could not be viewed" but the alert owner (splunk admins) opened the same link its opened and result also visible from their end. ... View more

in the search head I am not able to see the logs but logs are coming from the forwarder and no error found in splunkd please provide me the troubleshooting steps. ... View more