Dears, Looking for the customer dashboard if it is available with anyone to monitor many things like platform health (I know through MC but still), Parsing issue, timestamp, line braking, Add-on errors/warnings, available Use cases vs triggered in 30 days, HF syslog errors/warnings, indexes health, etc, and so, on it would be really helpful. ... View more

Hi All, I am finding an error, before it was working fine and all of a sudden started receiving the error logs, as checked connectivity is working.   ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" urllib.error.URLError: <urlopen error [Errno 111] Connection refused> ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" raise URLError(err)   ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" File "/opt/splunk/lib/python3.9/urllib/request.py", line 1349, in do_open ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" return self.do_open(http.client.HTTPSConnection, req, ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" File "/opt/splunk/lib/python3.9/urllib/request.py", line 1389, in https_open ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" result = func(*args) ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" File "/opt/splunk/lib/python3.9/urllib/request.py", line 494, in _call_chain ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" result = self._call_chain(self.handle_open, protocol, protocol + ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" File "/opt/splunk/lib/python3.9/urllib/request.py", line 534, in _open ERROR ExecProcessor [3111415 ExecProcessor] - message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/TA-rapid7_nexpose/bin/rapid7nexpose.py" response = self._open(req, data)   ... View more

Hi All, How to resolve the issue when the queues are full in indexer. Kindly let me know. ... View more

Hi All, Do we have SPL query to find SPL to identify the line breaking and event breaking issues through search heads. ... View more

We can not choose default source type _json while onboarding. Need to extract the json data within the log file, which is essential for an app owner. log format - 2024-01-01T09:50:44+01:00 hostname APP2SAP[354]: {JSON data} I have a splunk intermediate forwarder read these log files. Log file has non-json data followed by json data which bread n butter for application team (log format as shown above). If I forward the data as-is to splunk, extraction is not proper, since it has non-json data at beginning. Now, I need props n (or) transforms to extract, which I am not sure how. ... View more