The match function expects a regex string as the second parameter. In regex "*" is a modifier meaning zero or more of the previous match item. If "*" appears at the beginning of the regex expression, there is no previous match item, hence the error. ... View more

can anyone please assist for this error? Error message ERROR TcpInputProc [11836 FwdDataReceiverThread] - Message rejected. Received unexpected message of size=1009989438 bytes from src=xx.xx.xx.xx in streaming mode. Maximum message size allowed=67108864. (::) Possible invalid source sending data to splunktcp port or valid source sending unsupported payload. Here is my inputs.conf [udp://xx.xx.xx.xx:876] connection_host = dns host = xxxxxx index = yyyyyy sourcetype = hx_cef_syslog ... View more

Have you try to get this query working with MS SQL own tools? Check it with it and also ensure that you have correct indexes etc. defined to get response enough quickly. ... View more

Hello splunkers I am also facing the same issue and no data collection is happening due to this issue. Can anyone please guide?   ... View more

No. You have to assign a whole cluster to a single pool. You can't do a "this indexer uses this pool and that one uses another pool" cluster. All cluster members must share the same licensing pool. ... View more

Splunk DB Connect is a proven/tested/used-by-many application which supports multiple database. Apart from getting a easy to use solution, you'll get additional benefit of connection pooling and caching feature in Splunk DB Connect which other script might not have. You don't have to maintain the any script code and you can get updated version of the app if a new version of database is released. For these features, I'll use DB Connect and not a script (or develop a script). ... View more

Hi @spl10, the easiest way to have a copy of lookups having low grants, it's scheduling an alert for each lookup attaching the result to the email. In this way you have all the csv files on your email and you haven't problems to search csv files that, only for your information, are in $SPLUNK_HOME/var/run/splunk/csv. If you don't want many emails, you could use the search from @ITWhisperer to aggregate all lookups in one csv file and send it by alert to your email. One additional information: when you make backup of your apps, you also make the backup of your lookups. Ciao. Giuseppe ... View more