Hi, I have the Splunk_TA_nix installed and deployed. In generel it works. I activated the interfaces.sh which does give me IPv4-Adresses and IPv6 Link-Local-Adresses but none else. Since I have a primarily IPv6 environment I miss the most importent part but I don't understand why it delivers me the link-locals but not the public adresses? I could not find any documentation or anything about activating ipv6 for the interfaces.sh and since there are link-locals I guess it is activated but the script has maybe a bug. Can anyone tell me if theres a better documentation for this script anywhere or knows why it does not collect the ipv6 adresses? ... View more

Hi, I regularly have the problem, that I save searches containing regexes with $ characters to a dashboard where they are then not showing any result. I guess I have to escape them somehow. It seems while saving them the $ characters are automatically duplicated but it that is supposed to be some kind of escaping its not working. I could not find anything in the documentation but since there are plenty I was not shure where to look exactly. Can anyone tell me how to reliably use a | rex command in a dashboard? | rex field=_raw "\s(?<hash>\S+)$" ... View more

Hi, I took over a Splunk Cluster with Splunk on c:\program files\splunk which produces plenty of problems due to long path restrictions. Activating long path support does not work for splunk so I have to reinstall all instances on c:\splunk. But when trying to uninstall I get errors due to missing permission. I have admin priviliges, installed a test-cluster with all new instances but can't uninstall splunk for some reason. Of course I stopped splunk before trying to uninstall it. Can anyone tell me why even a freshly installed instance can't be uninstalled? I tried with 9.0.3 and 9.0.4. Kind Regards ... View more

Hi, I have a test instance of splunk - fresh out of the box. Only configure the essentials and imported a dump from the  OpenLibrary.org. I have the problem that every single line should be one event but plenty of lines are merged together and I can't figure out why. The source data has reliable linebreaks in so the default should work. I had the same issue in my enterprise environment and nobody could tell me why this is happening. After a while it magically disappeared and as far as I can tell it has vanished for good but I'd like to understand the reason why this is happening and prevent it from happening again. Regards Thorsten ... View more

I've tried to configure some reports to be send via email. I created a report which runs on a schedule an then send the report via mail. I receive an error like this: ERROR ScriptRunner [26364 AlertNotifierWorker-3] - stderr from 'C:\Program Files\[..]\sendemail.py "results_link=https://sea:443/app/search/@go?sid=scheduler__myuser__search__RMD5ca1c47b4433f8dbe_at_1675331100_258_5A6150E4-7C97-409F-AC0E-5BC487885B82" "ssname=xxx: myreport" "graceful=True" "trigger_time=1675331129" results_file="C:\Program Files\Splunk\var\run\splunk\dispatch\scheduler__myuser__search__RMD5ca1c47b4433f8dbe_at_1675331100_258_5A6150E4-7C97-409F-AC0E-5BC487885B82\results.csv.gz" "is_stream_malert=False"': ERROR:root:[WinError 10061] Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte while sending mail to: mail@mail.org I thougt it might be the smtp-gateway but sending mails via | sendemail command works fine.  Also some, but very few, reports go through. Also I checked wether sendmail.py tried to open a connection to the smtp-server but it seems the error comes from sendemail.py trying to open the url in results_link. And that is the point where I do not know what to look for anymore. ... View more