I created a kvstore on the search header cluster. When I clean up the environment and want to use API or CLI to delete and recreate the KVStore, I find that the data of the KVStore will recover on its own after a period of time. Why is this？ BR ... View more

When I developed an add on based on Splunk's cluster， encountering some problems: 1、I created an index named test from the indexes cluster of Splunk，Also through "./splunk edit cluster-config -mode searchhead -master_uri <Indexer Cluster Master URI>"    command linked search head cluster nodes with index clusters.   I want to write data to the index of this test through the Splunk API and obtain the written data from other search header nodes, but I found that it is not working. Is this related to my previous creation of indexes in the search header node. If it's relevant, how can I remove the index from the search header cluster？ 2、Is kvsore data synchronized in the search head cluster. What should I do if I want to clean up the environment and delete a KVStore in the search header cluster？ 3、What is the data communication mechanism between search head clusters, and do I want to achieve some data synchronization on add on between multiple search heads? Is there any good method? BR! ... View more

Cry for help！ I installed an add on in Splunk, but he can't open it normally, only a white screen appears.My Splunk version is 9.0.4. How should I solve this problem？ Thank all! Here is the  section error logs in web_services.log     2023-12-01 10:16:41,411 ERROR [65694209637fbde458fdd0] startup:112 - Unable to read in product version information; [HTTP 401] Client is not authenticated 2023-12-01 10:16:41,412 INFO [65694209637fbde458fdd0] startup:139 - Splunk appserver version=UNKNOWN_VERSION build=000 isFree=False isTrial=True 2023-12-01 10:16:41,413 INFO [65694209637fbde458fdd0] i18n_catalog:46 - i18ncatalog: translations_retrieved=0.0004456043243408203 etag_calculated=4.3392181396484375e-05 overall=0.0004889965057373047 2023-12-01 10:16:41,413 ERROR [65694209647fbde459b3d0] startup:112 - Unable to read in product version information; [HTTP 401] Client is not authenticated 2023-12-01 10:16:41,415 INFO [65694209647fbde459b3d0] startup:139 - Splunk appserver version=UNKNOWN_VERSION build=000 isFree=False isTrial=True 2023-12-01 10:16:41,416 INFO [65694209647fbde459b3d0] _cplogging:216 - [01/Dec/2023:10:16:41] ENGINE Started monitor thread 'Monitor'. 2023-12-01 10:16:41,416 INFO [65694209647fbde459b3d0] root:168 - ENGINE: Started monitor thread 'Monitor'. 2023-12-01 10:16:41,427 ERROR [65694209647fbde459b3d0] config:149 - [HTTP 401] Client is not authenticated Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 147, in getServerZoneInfoNoMem return times.getServerZoneinfo() File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/times.py", line 163, in getServerZoneinfo serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz', sessionKey=sessionKey) File "/opt/splunk/lib/python3.7/site-packages/splunk/rest/__init__.py", line 625, in simpleRequest raise splunk.AuthenticationFailed splunk.AuthenticationFailed: [HTTP 401] Client is not authenticated 2023-12-01 10:16:45,150 ERROR [6569420d237fbde4dc8290] startup:112 - Unable to read in product version information; [HTTP 401] Client is not authenticated 2023-12-01 10:16:45,151 INFO [6569420d237fbde4dc8290] startup:139 - Splunk appserver version=UNKNOWN_VERSION build=000 isFree=False isTrial=True 2023-12-01 10:16:45,159 ERROR [6569420d237fbde4dc8290] config:149 - [HTTP 401] Client is not authenticated Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/config.py", line 147, in getServerZoneInfoNoMem return times.getServerZoneinfo() File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/lib/times.py", line 163, in getServerZoneinfo serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz', sessionKey=sessionKey) File "/opt/splunk/lib/python3.7/site-packages/splunk/rest/__init__.py", line 625, in simpleRequest raise splunk.AuthenticationFailed splunk.AuthenticationFailed: [HTTP 401] Client is not authenticated         2023-12-01 10:36:53,327 INFO [656946c5357fdfe823efd0] error:321 - Masking the original 404 message: 'Nothing matches the given URI' with 'Page not found!' for security reasons 2023-12-01 10:36:53,329 INFO [656946c5347fdfe82389d0] error:321 - Masking the original 404 message: 'Nothing matches the given URI' with 'Page not found!' for security reasons 2023-12-01 10:36:53,342 INFO [656946c5357fdfe8216b90] startup:139 - Splunk appserver version=9.0.4 build=de405f4a7979 isFree=False isTrial=False 2023-12-01 10:36:53,430 INFO [656946c56c7fdfe818afd0] error:321 - Masking the original 404 message: 'Nothing matches the given URI' with 'Page not found!' for security reasons 2023-12-01 10:36:54,307 INFO [656946c64b7fdfe00b3e50] startup:139 - Splunk appserver version=9.0.4 build=de405f4a7979 isFree=False isTrial=False 2023-12-01 10:36:54,307 ERROR [656946c64b7fdfe00b3e50] utility:58 - name=javascript, class=Splunk.Error, lineNumber=3845, message=Uncaught TypeError: Cannot set properties of undefined (setting 'loadParams'), fileName=https://10.85.182.69:8000/zh-CN/manager/search/apps/local?msgid=5419270.9466664794685945 2023-12-01 10:36:54,307 ERROR [656946c64b7fdfe00b3e50] utility:58 - name=javascript, class=Splunk.Error, lineNumber=5, message=Uncaught TypeError: Cannot read properties of undefined (reading 'regional'), fileName=https://10.85.182.69:8000/zh-CN/static/@0775A864B66952FFC07DAC805E2AAC735374D88D0EA5463E9E4CF36CF62A4344.2/js/common.min.js         2023-12-01 10:37:37,961 INFO [656946f1f27fdfe8cddb50] error:321 - Masking the original 404 message: 'The path '/zh-CN/static/@0775A864B66952FFC07DAC805E2AAC735374D88D0EA5463E9E4CF36CF62A4344.2:1/app/qianxin-threat-intelligence-app/js/build/0.js' was not found.' with 'Page not found!' for security reasons 2023-12-01 10:37:37,963 INFO [656946f1f37fdfe80cb390] error:321 - Masking the original 404 message: 'The path '/zh-CN/static/@0775A864B66952FFC07DAC805E2AAC735374D88D0EA5463E9E4CF36CF62A4344.2:1/app/qianxin-threat-intelligence-app/js/build/3.js' was not found.' with 'Page not found!' for security reasons 2023-12-01 10:37:37,964 INFO [656946f1f37fdfe80b8c90] error:321 - Masking the original 404 message: 'The path '/zh-CN/static/@0775A864B66952FFC07DAC805E2AAC735374D88D0EA5463E9E4CF36CF62A4344.2:1/app/qianxin-threat-intelligence-app/js/build/1.js' was not found.' with 'Page not found!' for security reasons 2023-12-01 10:37:37,968 INFO [656946f1f57fdfe8c9a1d0] error:321 - Masking the original 404 message: 'The path '/zh-CN/static/@0775A864B66952FFC07DAC805E2AAC735374D88D0EA5463E9E4CF36CF62A4344.2:1/app/qianxin-threat-intelligence-app/js/build/4.js' was not found.' with 'Page not found!' for security reasons 2023-12-01 10:37:38,388 INFO [656946f2607fdfbc5dbad0] error:321 - Masking the original 404 message: 'The path '/zh-CN/static/@0775A864B66952FFC07DAC805E2AAC735374D88D0EA5463E9E4CF36CF62A4344.2:1/app/qianxin-threat-intelligence-app/js/build/5.js' was not found.' with 'Page not found!' for security reasons 2023-12-01 10:37:39,706 INFO [656946f3b27fdfe05e77d0] error:321 - Masking the original 404 message: 'The path '/zh-CN/static/@0775A864B66952FFC07DAC805E2AAC735374D88D0EA5463E9E4CF36CF62A4344.2:1/app/qianxin-threat-intelligence-app/js/build/1.js' was not found.' with 'Page not found!' for security reasons 2023-12-01 10:37:39,707 INFO [656946f3b27fdfbc533750] error:321 - Masking the original 404 message: 'The path '/zh-CN/static/@0775A864B66952FFC07DAC805E2AAC735374D88D0EA5463E9E4CF36CF62A4344.2:1/app/qianxin-threat-intelligence-app/js/build/5.js' was not found.' with 'Page not found!' for security reasons 2023-12-01 10:37:39,709 INFO [656946f3b17fdfe008eed0] error:321 - Masking the original 404 message: 'The path '/zh-CN/static/@0775A864B66952FFC07DAC805E2AAC735374D88D0EA5463E9E4CF36CF62A4344.2:1/app/qianxin-threat-intelligence-app/js/build/0.js' was not found.' with 'Page not found!' for security reasons         2023-12-01 10:59:07,462 INFO [65694bfb747fdfbc38f550] error:321 - Masking the original 404 message: 'The path '/en-US/static/app/search/$token_image_url$' was not found.' with 'Page not found!' for security reasons 2023-12-01 11:00:14,001 INFO [65694c3df97fdfbc5ccc50] startup:139 - Splunk appserver version=9.0.4 build=de405f4a7979 isFree=False isTrial=False 2023-12-01 11:00:14,072 INFO [65694c3df97fdfbc5ccc50] startup:139 - Splunk appserver version=9.0.4 build=de405f4a7979 isFree=False isTrial=False 2023-12-01 11:00:14,175 INFO [65694c3df97fdfbc5ccc50] cached:163 - /opt/splunk/etc/apps/search/appserver/static/setup.json 2023-12-01 11:00:14,437 INFO [65694c3df97fdfbc5ccc50] view:1137 - PERF - viewType=fastpath viewTime=0.2445s templateTime=0.0666s 2023-12-01 11:00:14,535 INFO [65694c3e807fdfe071d9d0] startup:139 - Splunk appserver version=9.0.4 build=de405f4a7979 isFree=False isTrial=False 2023-12-01 11:00:14,610 INFO [65694c3e957fdfe039f090] startup:139 - Splunk appserver version=9.0.4 build=de405f4a7979 isFree=False isTrial=False 2023-12-01 11:00:16,799 INFO [65694c40ca7fdfbc56c4d0] error:321 - Masking the original 404 message: 'The path '/en-US/static/app/search/$token_image_url$' was not found.' with 'Page not found!' for security reasons     such as this:     What problem caused the white screen to occur？ If you could help me, I would be extremely grateful！   ... View more

I want to add a command to my add on, with the aim of passing the splunk spl query results to that command, and then processing it to return the data to splunk's statistical information. there is my spl command:index="test" | stats count by asset | eval to_query=asset | fields to_query | compromiseBut the processing of requests in my command is synchronous, which consumes a lot of time def stream(self, records):     for record in records:         logger.info(records)         to_query = record.get("to_query")         data = self.ti_compromise(to_query)         logger.info(data)         if data:             res = deepcopy(record)             if data[to_query]:                 for ioc in data[to_query]:                     if not ioc["ioc"][2]:                         ioc["ioc"][2] = " "                     res.update({PREFIX + key: value for key, value in ioc.items()})                     yield res             else:                 res.update(EMPTY_RTN)                 yield res     The method of "self.ti_compromise(to_query)" is to request other interfaces.   Can I modify the above method to concurrent processing on Splunk?　If possible, which plan would be better。 Also, can the statistical information of Splunk receive list types, such as：   [ { "alert_name": "aaaaaaaaaaaa", "campaign": "", "confidence": "", "current_status": "", }, { "alert_name": "bbbbbbbbbbbb", "campaign": "", "confidence": "", "current_status": "", } ]         ... View more

Dear splunk developer, As the development team behind the app available at https://splunkbase.splunk.com/app/6962, we would like to address an issue we encountered during the publishing process. Unfortunately, we mistakenly published our app under the individual developer account instead of our enterprise account. We would like to inquire if it is possible to rectify this by changing the account associated with our app to our enterprise account, and have it displayed as being built by QAX.Inc. We are willing to provide any necessary information to facilitate this change. However, if changing the account is not feasible, we kindly request guidance on how to delete the current app so that we can create a new one using a different company account. We greatly appreciate your assistance in resolving this matter. Thank you. Best wishes, ... View more

Dear splunkers: I want to adapt my plugin to the Splunk cluster.  I have already set up the search head and peer cluster (one main node, two search head nodes, two peer nodes). But I don't know how Splunk clusters work. How can I test to prove that my plugin is suitable for Splunk clusters. Currently, the index database created from peer nodes can search for relevant data in the search header node. Can you help me? By the way:  The data I input from the peer node takes a long time to be found in the search header node. Why is this? ... View more

I stored a large amount of my own data (approximately 1 million pieces) in the splunkd lookup database and found that it took a long time and the server CPU and disk usage were high. Additionally, my multi core CPU only has a high workload of one core. What is this situation? What should I do to address my data storage and storage performance issues. ... View more

Dear All: I want to publish the application to Splunk，but I want to clarify some things，as follows: 1. How to publish your own program to Splunk. 2.What is the query efficiency of the Splunk log interface? For example, if I want to achieve a QPS of 9000, what is the minimum configuration that my machine should meet. 3.What is the minimum configuration that a machine can meet to meet the most basic performance Thank you~ ... View more