We are using splunk in Enterprise environemnt with Very large scale operation.  Management decided to address the question why is the above mentioned app included in the package? We are not using it and would like not to have it in the future. ... View more

Before upgrading in production can I ask for update notes , changelogs of Splunk Add-on for ServiceNow 7.4.1 >7.5.0 Thanks ... View more

Hello. I am trying to test app version before updating it in test environemnt but I receive an error after running command : ./splunk apply shcluster-bundle -target https://vxxxxxxx:8089 Error  :     WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details. Error while creating deployable apps: Error copying src="/opt/splunk/etc/shcluster/apps/Splunk_TA_snow" to staging area="/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow". 9 errors occurred. Description for first 9: [{operation:"copying source to destination", error:"Permission denied", src:"/opt/splunk/etc/shcluster/apps/Splunk_TA_snow/metadata/local.meta", dest:"/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow/metadata/local.meta"}, {operation:"transfering contents from source to destination", error:"Permission denied", src:"/opt/splunk/etc/shcluster/apps/Splunk_TA_snow/metadata", dest:"/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow/metadata"}, {operation:"copying source to destination", error:"Permission denied", src:"/opt/splunk/etc/shcluster/apps/Splunk_TA_snow/local/passwords.conf", dest:"/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow/local/passwords.conf"}, {operation:"copying source to destination", error:"Permission denied", src:"/opt/splunk/etc/shcluster/apps/Splunk_TA_snow/local/splunk_ta_snow_settings.conf", dest:"/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow/local/splunk_ta_snow_settings.conf"}, {operation:"copying source to destination", error:"Permission denied", src:"/opt/splunk/etc/shcluster/apps/Splunk_TA_snow/local/splunk_ta_snow_account.conf", dest:"/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow/local/splunk_ta_snow_account.conf"}, {operation:"transfering contents from source to destination", error:"Permission denied", src:"/opt/splunk/etc/shcluster/apps/Splunk_TA_snow/local", dest:"/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow/local"}, {operation:"copying source to destination", error:"Permission denied", src:"/opt/splunk/etc/shcluster/apps/Splunk_TA_snow/lookups/snow_cmdb_ci_list.csv", dest:"/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow/lookups/snow_cmdb_ci_list.csv"}, {operation:"transfering contents from source to destination", error:"No such file or directory", src:"/opt/splunk/etc/shcluster/apps/Splunk_TA_snow/lookups", dest:"/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow/lookups"}, {operation:"transfering contents from source to destination", error:"No such file or directory", src:"/opt/splunk/etc/shcluster/apps/Splunk_TA_snow", dest:"/opt/splunk/var/run/splunk/deploy.618738529d3d8db4.tmp/apps/Splunk_TA_snow"}]     Looks like permissions denied. I tried with both root user and splunk user error stays the same.   ... View more

We set up a service measuring datastore free space usage, overprovisioning , read and write activity. Large amount of entities  are shown and per entity thresholds are working fine. However the aggregated threshold for the KPIs show only the values of the top entity.  According to manual the aggregated threshold should present an average of all entities result. Is there a setting I am not using correct? ... View more