I am running into an issues where I am attempting to import data from a SQL Server database, one of the columns is entitled message, contains  message payload with the character '{' in it.  When Splunk Process the data from DB Connect, it inappropriately truncates the message when it sees the '{' bracket in the document.  Are there solutions for overriding this line breaking feature?  We currently have to go into Raw to extract the information using RegEx to preserve the data and we would rather store this message in a Splunk Key Value Pair.   ... View more

We are looking to configure the Splunk Add-on for Microsoft Cloud Services to use a Service Principal as opposed to a client key.  The documentation for the Add-On does not provide insight into how one would configure the Splunk Add-on for Microsoft Cloud Services to work with a Service Principal.  Does the Splunk Add-on for Microsoft Cloud Services service principals for authentication?   ... View more

We currently have a report that will be emailed on a nightly basis, It will send and email with an attachment that includes an XLS and a PDF that contains the xls.  The PDF exports as expected, but when Splunk emails the PDF, it says "No Matching Events found".  When we send the XLS as part of the communication, it contains the contents of the report as expected.  It was working fine up until a few weeks back, then the PDF stopped producing results while the XLS continues to function as expected.   I have searched the logs and have found no errors that would prevent the report from being generated, not sure where to  look at this point to determine why PDF is not producing results.   Splunk Cloud Version:  9.1.2308.203 build d153a0fad666 ... View more

We are in the process of generating Events in ServiceNow using the Splunk add-on for ServiceNow.  We are passing Event information in the description field to communicate to the end user what actions need to be addressed.  As part of the output we want to include a table of information that summarizes the events detected.  We are able to aggregate and group the information as necessary, just having a hard time establishing a pattern where we can consistently control the output.    We have had issues formatting the data and we are seeking guidance on how we can exert greater control over the format.  We would like to include a brief sentence with instructions on how to move forward and we would like to identify all events impacted in table format.    |eval instructions = "The message we are seeking would look like the content below:  The header column and the output needs to be aligned and easy to read for the end user.    I have used a MVAppend Statement to add the header to a column, but could not concatenate the information in a manner where it display the information in a table format.   "  . " " | eval cheader = "Host Account Action " | eval tabledata= host . " " . Account . " " . Action | eval instructions = instructions . cheader . tabledata   "The account is a controlled account and you will need to provide justification for accessing the account outside of security controls.  Please review the table of events and provide insight into why control was violated." Table of Events:   Host                      Account           Action     LC200506         admin                Success  LC200507         admin                Failure     ... View more