I need help in sending data to two output types, [tcpout] and [httpout]. Is this possible? Because when I am using outputs.conf and pointing it to two output types, I can only see data to [httpout] https://hecendpoint:8088 and data is not going to another indexer which is of [tcpout] indexerip:9997 ... View more

I have successfully implemented this thing in my personal account and it works fine with the local HEC -> splunk cloud,  but in my organization's environment local HEC gives a successful response code but the indexer fails to index the data because HEC couldn't send data to Splunk cloud indexers.    I noticed that I am not able to connect to the indexer's domain name or IP address on port 9997 do I need to explicitly allow any rule from Splunk cloud for indexers? ... View more

splunklib.binding.HTTPError: HTTP 500 Internal Server Error -- b'{"messages":[{"type":"ERROR","text":"Cannot call handler \'splunk_ta_aws_settings_proxy\' due to missing script \'aws_proxy_settings_rh.py\'."}]}' 2022-06-18 19:03:38,719 level=INFO pid=14431 tid=MainThread logger=splunksdc.collector pos=collector.py:run:270 | | message="Modular input exited." 2022-06-18 19:03:51,931 level=INFO pid=14435 tid=MainThread logger=splunksdc.collector pos=collector.py:run:267 | | message="Modular input started." 2022-06-18 19:03:51,940 level=ERROR pid=14435 tid=MainThread logger=splunk_ta_aws.modinputs.sqs_based_s3.handler pos=utils.py:wrapper:77 | datainput="SqsBasedS3Input" start_time=1655579031 | message="Data input was interrupted by an unhandled exception." Traceback (most recent call last): File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/bin/splunksdc/utils.py", line 75, in wrapper return func(*args, **kwargs) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/bin/splunk_ta_aws/modinputs/sqs_based_s3/handler.py", line 857, in run proxy = ProxySettings.load(config) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/bin/splunk_ta_aws/common/proxy.py", line 40, in load virtual=True, File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/bin/splunksdc/config.py", line 38, in load content = self._cached_load(path) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/bin/splunksdc/config.py", line 52, in _cached_load content = self._fresh_load(path) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/bin/splunksdc/config.py", line 64, in _fresh_load elements = self._get(path, query) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/bin/splunksdc/config.py", line 68, in _get response = self._service.get(path, **query) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/lib/splunklib/binding.py", line 288, in wrapper return request_fun(self, *args, **kwargs) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/lib/splunklib/binding.py", line 69, in new_f val = f(*args, **kwargs) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/lib/splunklib/binding.py", line 684, in get response = self.http.get(path, all_headers, **query) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/lib/splunklib/binding.py", line 1197, in get return self.request(url, { 'method': "GET", 'headers': headers }) File "/opt/splunk/etc/slave-apps/Splunk_TA_aws/lib/splunklib/binding.py", line 1260, in request raise HTTPError(response) splunklib.binding.HTTPError: HTTP 500 Internal Server Error -- b'{"messages":[{"type":"ERROR","text":"Cannot call handler \'splunk_ta_aws_settings_proxy\' due to missing script \'aws_proxy_settings_rh.py\'."}]}' 2022-06-18 19:03:51,942 level=INFO pid=14435 tid=MainThread logger=splunksdc.collector pos=collector.py:run:270 | | message="Modular input exited."   Earlier it was working fine, it's not working post i tried changing password.conf file, what should i do now? Reverting the password.conf is not working  ... View more

how do i setup my indexer with Splunk aws add on from config files, our indexers doesn't have web. UI.   The question is how do I update Secret Key and Access Key from the backend within the indexers /opt/splunk/etc/slave-app/Splunk_TA_aws/?  is there any file which i need to update? ... View more

I want to run Heavyforwarder in autoscaling group in stateless mode, Can I do it without worrying about data directory /opt/splunk?    ... View more

Is it possible to restrict specific role to search index=* * but allow access for a specific dashboard? ... View more

I am using the nginx app to ship nginx logs to Splunk, everything works well but intermittently I see a single event consisting of multiple nginx access loglines.  Nginx app itself has an EventBreaker=enabled and Eventbreaker=regex. (This doesn't work 10-20% of the time). Can someone please help or am I missing something? My inputs.conf : [monitor:///var/log/nginx-access.log] index = artifactory disabled = false source = nginx-access sourcetype = nginx:plus:kv [monitor:///var/log/nginx-error.log] disabled = false sourcetype = nginx:plus:error index = artifactory source = nginx-error. Nginx app has already created props.conf at Search head cluster. ... View more