This was it for me. Even though I had set Mail Server Settings (under Server settings > Email settings), it still needed me to specify the server. ... View more

This was the issue for me as well, but unfortunately renaming isn't as straight forward. PackageName is a GUID, not a filename. Since I deploy through Intune, I assume this is why. The GUID is likely of the app package file. In the end, I used Orca to change the PackageCode and ProductCode GUIDs. Then, I could install like normal,   msiexec.exe /i "C:\Path\To\splunkuf.msi"   Why? There's no easy way to change the service account credentials or the Pass4SymmKey. A reinstall is the easiest, and the most reliable. Using MSIs in this way is a bit "unorthodox". ... View more

Edit: This one should be more accurate and will also let you use the date picker.   index=_internal host="SPLUNK_DS_NAME" component=PubSubSvr event_message="Subscribed*" | eval hostname=mvindex(split(connectionId, "_"), 4) | search hostname!="direct" | eval guid=mvindex(split(connectionId, "_"), 5) | dedup guid sortby +_time | join guid type=inner [search index=_internal host="SPLUNK_DS_NAME" component=PubSubSvr event_message="Subscribed*" earliest=1 | eval hostname=mvindex(split(connectionId, "_"), 4) | search hostname!="direct" | eval guid=mvindex(split(connectionId, "_"), 5) | eval h_time=_time | dedup guid sortby +_time | fields guid, h_time] | addinfo | eval firstSeenDiff=_time-h_time | eval pickerDiff=now()-info_min_time | where pickerDiff>=firstSeenDiff | eval lastSeen=strftime(_time, "%Y-%m-%d %H:%M:%S") | eval firstSeen=strftime(h_time, "%Y-%m-%d %H:%M:%S") | table lastSeen, firstSeen, guid, hostname   This seems to be the earliest date stamp of events, not the forwarder check-in.   index=_internal source=*metrics.log group=tcpin_connections | dedup guid | table _time, guid, hostname   (Simplified version of Solved: Re: Listing forwarders - Splunk Community) I then realized this was just for forwarders sending data. Although it would be strange, you can have forwarders connected to just the DS.   index=_internal host="SPLUNK_DS_HOSTNAME" component=PubSubSvr event_message="Subscribed*" | eval hostname=mvindex(split(connectionId, "_"), 4) | search hostname!="direct" | eval guid=mvindex(split(connectionId, "_"), 5) | dedup guid sortby +_time | table _time, guid, hostname     ... View more

The REST data input is quite simple. You'll have to code in order to get it to pull more pages. This would be a good feature request. I don't see it being difficult to implement. ... View more

It's likely due to the lxml module. Check out my reply here as I've solved the error: https://community.splunk.com/t5/All-Apps-and-Add-ons/After-installing-Splunk-Add-on-Builder-why-do-I-receive-error/m-p/579927#M75833 ... View more

For me, 4.0.0 was the version throwing the error and rolling back to 3.0.1 was the workaround. I've got an open case with Splunk, but it seems I may have finally solved it. When searching _internal, I came across this:   "01-04-2022 10:13:36.430 -0600 ERROR ModularInputs [18196 MainThread] - <stderr> Introspecting scheme=validation_mi: ImportError: cannot import name 'etree' from 'lxml' (C:\Program Files\Splunk\etc\apps\splunk_app_addon-builder\bin\splunk_app_add_on_builder\lxml\__init__.py)" "01-04-2022 10:13:36.430 -0600 ERROR ModularInputs [18196 MainThread] - <stderr> Introspecting scheme=validation_mi: from lxml import etree" "01-04-2022 10:13:36.430 -0600 ERROR ModularInputs [18196 MainThread] - <stderr> Introspecting scheme=validation_mi: File ""C:\Program Files\Splunk\etc\apps\splunk_app_addon-builder\bin\tabuilder_utility\data_input_util.py"", line 10, in <module>" "01-04-2022 10:13:36.430 -0600 ERROR ModularInputs [18196 MainThread] - <stderr> Introspecting scheme=validation_mi: Traceback (most recent call last):"   At first, I thought it was that the module was missing or it couldn't find it. But as you can see by ... ImportError: cannot import name 'etree' from 'lxml' (C:\Program Files\Splunk\etc\apps\splunk_app_addon-builder\bin\splunk_app_add_on_builder\lxml\__init__.py ... that it does. I did a bit of poking around on PyPi and noticed their version wasn't the same as the app's. I believe the app used the source. Long story short, Splunk Enterprise 8.2.3 uses Python 3.7 and AOB 4.0.0 uses lxml 4.6.3. Steps below will stop the error from appearing. Browse https://pypi.org/project/lxml/4.6.3/#files for the appropriate wheel (probably this one since most use Linux). Navigate to C:\Program Files\Splunk\etc\apps\splunk_app_addon-builder\bin\splunk_app_add_on_builder (or similar for Linux) Delete folders lxml and lxm-4.6.3-dist-info Copy the replacement folders (can open .whl with 7Zip) Restart Splunk. ... View more