Hi, Anyone figured out the way to integrate please?  ... View more

Would the Akamai add-on work with the Akamai Prolexic Analytics API ? ... View more

I realise this post is 6 years old, but it still helped me. Just to add something that might be useful: When it asks for the Splunk username, this isn't a Linux user account, it's an application user account on the Deployment Server. It's confusing because many other Splunk commands can be run by Linux user accounts, but it seems not the 'deploy-server reload' command. $ /opt/splunk/bin/splunk reload deploy-server Your session is invalid. Please login. Splunk username: admin Also, you can append '-class [serverclass name] onto the end of the command and only changes made to the corresponding deployment apps will get reloaded, so this is perhaps a safer option if you're nervous about reloading everything. ... View more

DB connect cannot be used with FREE license splunk. !!! This information is extremely important for me, maybe not only for me. Great Thanks !! and I could not see this massage easily. keyword: "task server is running" wait for long time rounding circle ... View more

I got the SCCM app working today with a lot of frustration and time rewriting the SQL queries for DB Connect. We're using Splunk Enterprise 8.2.0 and DB Connect 3.5.1 Once I got these searches working, I had to go through the macros and lookups and update them for the current DB Connect term, ie. dbquery became |dbxquery. I wouldnt have been able to solve most of the complex queries without this article, Troubleshooting Tips for Splunk DB Connect 3 | Function1  Hope that helps.   ********************************************************************* Status: ********************************************************************* [sccm_agent_discoveries_dbinput] Works as intended [dbmon-tail://sccm/sccm_status_message_dbinput] Works, but not as intended [dbmon-tail://sccm/sccm_installed_software_dbinput] Works as intended [dbmon-tail://sccm/ta_sccm_malware_dbinput] Will not execute - Empty table/views, this is more an issue with SCCM not having the appropriate data to populate the view. [dbmon-tail://sccm/sccm_resource_dbinput] Works as intended ********************************************************************* [sccm_agent_discoveries_dbinput] ********************************************************************* SELECT AgentTime, [v_R_System].ResourceID, [v_R_System].Netbios_Name0 AS "name", AgentName FROM [CM_360].[dbo].[v_AgentDiscoveries] LEFT JOIN [v_R_System] ON [v_AgentDiscoveries].ResourceId = [v_R_System].ResourceID WHERE AgentTime > ? ORDER BY AgentTime ASC ********************************************************************* [dbmon-tail://sccm/sccm_status_message_dbinput] This works, but not as intended. The search is an upgraded version of the original. RecordID fails as a rising column. Timestamp is not an ideal rising column because if there are multiple entries for the same time, all but one of the rows will be skipped. The workaround is to set the rising column to timestamp with a >= clause to catch everything. ************************************************************* SELECT RecordID, timestamp, timestamputc, MessageID, Severity, severityid, MachineName, SiteCode, ModuleName, Component, string1, string2, string3, string4, string5, string6, string7, string8, string9, string10, packageid, advertisementid, collectionid, username, dp, policyid, policyassignmentid, meter_ruleid, client_sms_uniqueid site_code, package_version time_key, unique_updateid productid, ci_assignmentid, objectid, object_type, sdm_typeid, sdm_type_version, update_source_uniqueid, collection_extended_propsid, wol_object_type wol_batchid, machine_extended_propsid, wol_num_requests, unknown_machine, mac_addresses, smbiosid FROM (SELECT msg.RecordID, convert(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), msg.[Time] ),DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS [timestamp], msg.[Time] AS [timestamputc], msg.MessageID, Severity = CASE msg.Severity WHEN 1073741824 THEN 'informational' WHEN -1073741824 THEN 'error' WHEN -2147483648 THEN 'warning' END, msg.Severity AS severityid, msg.MachineName, msg.SiteCode, msg.ModuleName, msg.Component, replace(strings.InsString1,'"','') AS string1, replace(strings.InsString2,'"','') AS string2, replace(strings.InsString3,'"','') AS string3, replace(strings.InsString4,'"','') AS string4, replace(strings.InsString5,'"','') AS string5, replace(strings.InsString6,'"','') AS string6, replace(strings.InsString7,'"','') AS string7, replace(strings.InsString8,'"','') AS string8, replace(strings.InsString9,'"','') AS string9, replace(strings.InsString10,'"','') AS string10, packageid, advertisementid, collectionid, username, replace(dp,'"','') AS dp, policyid, policyassignmentid, meter_ruleid, client_sms_uniqueid, site_code, package_version, time_key, unique_updateid, productid, ci_assignmentid, objectid, object_type, sdm_typeid, sdm_type_version, update_source_uniqueid, collection_extended_propsid, wol_object_type, wol_batchid, machine_extended_propsid, wol_num_requests, unknown_machine, mac_addresses, smbiosid FROM "CM_360"."dbo"."v_StatusMessage" msg LEFT JOIN "CM_360"."dbo"."v_StatMsgWithInsStrings" strings ON msg.RecordID = strings.RecordID LEFT JOIN (SELECT RecordID, [400] AS [packageid], [401] AS [advertisementid], [402] AS [collectionid], [403] AS [username], [404] AS [dp], [405] AS [policyid], [406] AS [policyassignmentid], [407] AS [meter_ruleid], [408] AS [client_sms_uniqueid], [409] AS [site_code], [410] AS [package_version], [411] AS [time_key], [412] AS [unique_updateid], [413] AS [productid], [414] AS [ci_assignmentid], [415] AS [objectid], [416] AS [object_type], [417] AS [sdm_typeid], [418] AS [sdm_type_version], [419] AS [update_source_uniqueid], [420] AS [collection_extended_propsid], [421] AS [wol_object_type], [422] AS [wol_batchid], [423] AS [machine_extended_propsid], [424] AS [wol_num_requests], [425] AS [unknown_machine], [426] AS [mac_addresses], [427] AS [smbiosid] FROM (SELECT RecordID, AttributeID, AttributeValue FROM "CM_360"."dbo"."v_StatMsgAttributes" ) AS s PIVOT ( MAX(AttributeValue) FOR AttributeID IN ([400], [401], [402], [403], [404], [405], [406], [407], [408], [409], [410], [411], [412], [413], [414], [415], [416], [417], [418], [419], [420], [421], [422], [423], [424], [425], [426], [427]) ) AS piv) AS test ON msg.RecordID = test.RecordID) AS querytest WHERE timestamp >= ? ORDER BY timestamp ASC ********************************************************************* [dbmon-tail://sccm/sccm_installed_software_dbinput] ********************************************************************* SELECT timestamp, ResourceID, active, SoftwarePropertiesHash0, SoftwarePropertiesHashEx0, product_name, product_version, product_publisher, installation_date, category, family FROM ( SELECT timestamp, ResourceID, active=1, SoftwarePropertiesHash0, SoftwarePropertiesHashEx0, NormalizedName AS product_name, NormalizedVersion AS product_version, NormalizedPublisher AS product_publisher, InstallDate0 AS installation_date, CategoryName AS category, FamilyName AS family FROM "CM_360"."dbo"."v_GS_INSTALLED_SOFTWARE_CATEGORIZED" UNION ALL SELECT "v_HS_INSTALLED_SOFTWARE".timestamp, "v_HS_INSTALLED_SOFTWARE".ResourceID, active=0, "v_HS_INSTALLED_SOFTWARE".SoftwareproPertiesHash0, "v_HS_INSTALLED_SOFTWARE".SoftwarePropertiesHashEx0, coalesce ("v_LU_SoftwareList".CommonName, "v_HS_INSTALLED_SOFTWARE".ProductName0) AS product_name, coalesce ("v_LU_SoftwareList".CommonPublisher, "v_HS_INSTALLED_SOFTWARE".Publisher0) AS product_publisher, coalesce ("v_LU_SoftwareList".CommonVersion, "v_HS_INSTALLED_SOFTWARE".ProductVersion0) AS product_version, InstallDate0 AS installation_date, "v_LU_Family".FamilyName, "v_LU_Category".CategoryName FROM "v_HS_INSTALLED_SOFTWARE" LEFT OUTER JOIN "v_LU_SoftwareHash" ON "v_LU_SoftwareHash".SoftwarePropertiesHash = "v_HS_INSTALLED_SOFTWARE".SoftwarePropertiesHash0 LEFT OUTER JOIN "v_LU_SoftwareList" ON "v_LU_SoftwareList".SoftwareID = "v_LU_SoftwareHash".SoftwareID INNER JOIN "v_LU_Category" ON "v_LU_Category".CategoryID = coalesce("v_LU_SoftwareList".CategoryID, 4892) INNER JOIN "v_LU_Family" ON "v_LU_Family".FamilyID = coalesce("v_LU_SoftwareList".FamilyID, 4891) WHERE SoftwarePropertiesHash0 is NOT NULL ) AS software WHERE timestamp >= ? ORDER BY timestamp ASC ********************************************************************* [dbmon-tail://sccm/ta_sccm_malware_dbinput] Will not execute - Empty table/views ********************************************************************* with malware AS (SELECT m.detectiontime AS [timestamp], 'SystemCenterEndpointProtection' AS vendor_product, 'SecurityIncident' AS [type], 'MalwareInfection' AS action_type, m.resourceid, sys.Netbios_Name0 AS dest_name, sys.Resource_Domain_OR_Workgr0 AS dest_nt_domain, m.detectiontime, m.actiontime, m.ProductVersion AS product_version, m.detectionid, CASE WHEN m.DetectionSource = 0 THEN 'unknown' WHEN m.DetectionSource = 1 THEN 'user' WHEN m.DetectionSource = 2 THEN 'system' WHEN m.DetectionSource = 3 THEN 'realtime' WHEN m.DetectionSource = 4 THEN 'ioav' WHEN m.DetectionSource = 5 THEN 'nis' WHEN m.DetectionSource = 6 THEN 'bho' END AS detection_source, m.UserName AS [user], m.Process AS target_process, m.Path AS file_path, ISNULL(metaData.Name,'unknown') AS [signature], IsNULL(sev.Severity,'unknown') AS severity, IsNULL(cat.Category,'invalid') AS category, CASE WHEN CleaningAction = 0 THEN 'unknown' WHEN CleaningAction = 1 THEN 'clean' WHEN CleaningAction = 2 THEN 'quarantine' WHEN CleaningAction = 3 THEN 'remove' WHEN CleaningAction = 6 THEN 'allow' WHEN CleaningAction = 8 THEN 'userdefined' WHEN CleaningAction = 9 THEN 'noaction' WHEN m.CleaningAction = 10 THEN 'block' END AS action_type, CASE WHEN CleaningAction = 0 THEN 'unknown' WHEN CleaningAction = 1 THEN 'blocked' WHEN CleaningAction = 2 THEN 'deferred' WHEN CleaningAction = 3 THEN 'blocked' WHEN CleaningAction = 6 THEN 'allowed' WHEN CleaningAction = 8 THEN 'unknown' WHEN CleaningAction = 9 THEN 'allowed' WHEN m.CleaningAction = 10 THEN 'blocked' END AS [action], CASE WHEN m.ActionSuccess =1 THEN 'true' ELSE 'false' END AS action_result, m.ErrorCode AS action_error_code, CASE WHEN m.PendingActions & 4 <> 0 THEN 'fullscan' WHEN m.PendingActions & 8 <> 0 THEN 'reboot' WHEN m.PendingActions & 16 <> 0 THEN 'settingsmodified' WHEN m.PendingActions & 32768 <> 0 THEN 'systemsweeper' ELSE 'noaction' END AS pending_action FROM v_GS_Threats m LEFT JOIN v_R_System sys ON m.ResourceID = sys.ResourceID LEFT JOIN v_ThreatCatalog metadata ON m.ThreatID = metadata.ThreatID LEFT JOIN v_ThreatSeverities sev ON metaData.SeverityID=sev.SeverityID LEFT JOIN v_ThreatCategories cat ON metaData.CategoryID=cat.CategoryID ) SELECT * FROM malware ********************************************************************* [dbmon-tail://sccm/sccm_resource_dbinput] ********************************************************************* SELECT timestamp, resourceid, resource_type, name, smsid, sitecode, domain, clientedition, clienttype, clientversion, isclient, isobsolete, isactive, isvirtualmachine, isaoaccapable, deviceowner, suppressautoprovision, isapproved, isblocked, isalwaysinternet, isinternetenabled, clientcerttype, username, lastclientchecktime, clientcheckpass, adsitename, userdomainname, adlastlogontime_epoch, clientremediationsuccess, clientactivestatus, laststatusmessage_epoch, lastpolicyrequest_epoch, lastddr_epoch, lasthardwarescan_epoch, lastsoftwarescan_epoch, lastmpservername, lastactivetime_epoch, cp_status, cp_latestprocessingattempt, cp_lastinstallationerror, deviceos, ep_deploymentstate, ep_deploymenterrorcode, ep_deploymentdescription, ep_policyapplicationstate, ep_policyapplicationerrorcode, ep_policyapplicationdescription, ep_enabled, ep_clientversion, ep_productstatus, ep_engineversion, ep_antivirusenabled, ep_antivirussignatureversion, ep_antivirussignatureupdatedatetime_epoch, ep_antispywareenabled, ep_antispywaresignatureversion, ep_antispywaresignatureupdatedatetime_epoch, ep_lastfullscandatetimestart_epoch, ep_lastfullscandatetimeend_epoch, ep_lastquickscandatetimestart_epoch, ep_lastquickscandatetimeend_epoch, ep_infectionstatus, ep_pendingfullscan, ep_pendingreboot, ep_pendingmanualsteps, ep_pendingofflinescan, ep_lastinfectiontime_epoch, ep_lastthreatname, unknown FROM (SELECT CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), COALESCE("lastactivetime", "disc"."lastdiscoverytime")), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS [timestamp], "machineid" AS "resourceid", CASE "architecturekey" WHEN 5 THEN 'system' WHEN 2 THEN 'unknown system' END AS "resource_type", "name", "smsid", "sitecode", "domain", "clientedition", "clienttype", "clientversion", "isclient", "isobsolete", "isactive", "isvirtualmachine", "isaoaccapable", "deviceowner", "suppressautoprovision", "isapproved", "isblocked", "isalwaysinternet", "isinternetenabled", "clientcerttype", "username", "lastclientchecktime", "clientcheckpass", "adsitename", "userdomainname", "adlastlogontime" AS "adlastlogontime_epoch", "clientremediationsuccess", "clientactivestatus", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "laststatusmessage"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "laststatusmessage_epoch", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "lastpolicyrequest"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "lastpolicyrequest_epoch", "lastddr" AS "lastddr_epoch", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "lasthardwarescan"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "lasthardwarescan_epoch", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "lastsoftwarescan"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "lastsoftwarescan_epoch", "lastmpservername", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), COALESCE("lastactivetime", "disc"."lastdiscoverytime")), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS lastactivetime_epoch, "cp_status", "cp_latestprocessingattempt", "cp_lastinstallationerror", "deviceos", "ep_deploymentstate", "ep_deploymenterrorcode", "ep_deploymentdescription", "ep_policyapplicationstate", "ep_policyapplicationerrorcode", "ep_policyapplicationdescription", "ep_enabled", "ep_clientversion", "ep_productstatus", "ep_engineversion", "ep_antivirusenabled", "ep_antivirussignatureversion", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "ep_antivirussignatureupdatedatetime"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "ep_antivirussignatureupdatedatetime_epoch", "ep_antispywareenabled", "ep_antispywaresignatureversion", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "ep_antispywaresignatureupdatedatetime"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "ep_antispywaresignatureupdatedatetime_epoch", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "ep_lastfullscandatetimestart"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "ep_lastfullscandatetimestart_epoch", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "ep_lastfullscandatetimeend"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "ep_lastfullscandatetimeend_epoch", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "ep_lastquickscandatetimestart"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "ep_lastquickscandatetimestart_epoch", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "ep_lastquickscandatetimeend"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "ep_lastquickscandatetimeend_epoch", "ep_infectionstatus", "ep_pendingfullscan", "ep_pendingreboot", "ep_pendingmanualsteps", "ep_pendingofflinescan", CONVERT(datetime, SWITCHOFFSET(CONVERT(DATETIMEOFFSET(3), "ep_lastinfectiontime"), DATENAME(TzOffset, SYSDATETIMEOFFSET()))) AS "ep_lastinfectiontime_epoch", "ep_lastthreatname", "unknown" FROM "CM_360"."dbo"."v_CombinedDeviceResources" INNER JOIN (SELECT "ResourceId", MAX("agenttime") AS "lastdiscoverytime" FROM "CM_360"."dbo"."v_agentdiscoveries" GROUP BY "ResourceId") AS "disc" ON "disc"."ResourceId" = "CM_360"."dbo"."v_combineddeviceresources"."machineid") as query WHERE timestamp > ? ORDER BY timestamp ASC      ... View more

Hello, please, you could say, how resolve this problem? what do you actions you applicated?  Thank you ... View more

Hello, any answer for this question. In search mode, like others people say : you can search <your_search> field=*_* In like command, underscore (like percent) is a wildcard (percent is ".*" and underscore is "."). You have to use match with real regex. Exemple : <your_search> | where match(field,".*_.*")   ... View more

Please be sure to get @rgresham_splunk  instead of me as I may not be able to help as much 🙂 ... View more

If your Status points are fixed i.e. A, B, C and D and for various elements you just need to show status at those end points, it does not seem like graph viz. Is your use case for Status Tracker? Can you add more details of your use case and provide some sample data and mock of what output you need? You are better off creating a new question as it seems different from the one asked here. Do check out Status Matrix Custom Viz if it solves your needs. ... View more

Wow, I don't get it. I've never done that before and never had issues but that did it. Thanks ... View more

Hi , This usually happens when a forwarder cannot send something to an indexer. Is splunk running on your indexer? Is the input's port open? Can the forwarder connect to the input's port? ... View more

Are you looking for this? maxHotSpanSecs = * Upper bound of timespan of hot/warm buckets in seconds. https://docs.splunk.com/Documentation/Splunk/7.2.0/Admin/Indexesconf maxHotSpanSecs = 259200 ... View more

hi @RogerMay No, I have raised a case with splunk support and they are still investigating. ... View more

Sticking to that example, I'd recommend letting existing authentication and authorization solutions tackle that. Most LDAP servers will block users after too many failed authentications, for example. I'm guessing you just used a simple example to illustrate things though... if the ruleset in general is way more complex, you could consider running the rules as often as you can - e.g. updating the number of failed authentications per user every ten minutes - and writing that decision out to a database. Then have the webapp talk to that database, e.g. "deny auth if table splunk_ruleset_blocked_users has an entry for that user within the last hour". Even with a truckload of hardware you're not going to achieve 50 splunk searches launched and completed within that second response time you've asked for. ... View more

Oh sorry . For next 6 month's , you have to use machine learning. There is a app called ML toolkit. By which you are write various regression techniques and show future data. Or there is a command called predict , you can use that also ... View more

Hi , Can you use timechart instead of stats and use span of 1month over there ... View more

hi for the moment job has not been completed it will be done at 8:00 what i dont understand is why the history of the dashboard is not saved ... View more

This turned out to be an odd one for me and I am still scratching my head. I initially installed the Universal Forwarder without selecting anything to forward from the Windows GUI for 'Advanced Options' ... thinking that I could just do a 'clean' install and edit the inputs.conf file - since I had already entered the Splunk Server receiver details in the GUI. Anyway, this approach did not work. Yes, I stopped the service. Yes, I made the same changes to inputs.conf ... but it didn't work. So I uninstalled the Universal Forwarder and re-installed, but that time I did put in the directory of the logs I wanted to monitor. I went back and made the changes for the ms:iis:auto sourcetype in inputs.conf and restarted. That worked. So I am left with the sinking feeling that, on Windows at least, Spunk is doing something under hood that is not in the config files. I find that kind of troubling. Thanks again for the responses. ... View more

Hi , Yes, It can be possible . Create an incident or event from an alert using the snow_incident.py or snow_event.py script You can create an incident or event based on an alert. In Splunk Web, click Settings > Searches, Reports, and Alerts. Click New. Set the Destination app to Splunk Add-on for ServiceNow (Splunk_TA_snow). Enter a Search name that describes the alert you want to create. Enter a Search that meets the following criteria: To create an incident, the search must include the mandatory arguments category, short_description, and contact_type. These arguments are required by ServiceNow to create an incident. The Splunk platform passes the arguments through to the alert result to trigger the script. To create an event, the search must include the mandatory arguments node, resource, type, and severity. These arguments are required by ServiceNow to create an event. The Splunk platform passes the arguments to the alert result to trigger the script. The search can include any of the optional arguments supported by ServiceNow incident or event creation. See About the commands and scripts for a table detailing each of these arguments. The search must be in tabular format. The following search is an example that demonstrates how to trigger the script to create an incident when CPU usage is 95 or higher. sourcetype="CPURates" earliest=-5m latest=now | stats avg(CPU) as CPU last(_time) as time by host | where CPU>=95 | eval contact_type="email" | eval ci_identifier=host | eval priority=1 | eval category="Software" | eval subcategory="database" | eval short_description="CPU on ". host ." is at ". CPU | table category, subcategory, short_description, contact_type, ci_identifier, priority The following search is an example that demonstrates how to trigger the script to create an event when CPU usage is 95 or higher: sourcetype="CPURates" earliest=-5m latest=now | stats avg(CPU) as CPU last(_time) as time by host | where CPU>=95 | eval node=host | eval resource="CPU" | eval type="CPUAlert" | eval severity=2 | eval description="CPU on ". host ." is at ". CPU | table time, severity, node, resource, type, description Under Schedule and alert, click Schedule this search. Select values for Schedule type, Run every, Expiration, and Severity according to your alert requirements. Under Alert actions, check the box next to Enable under Run a script. Enter the name of the script in File name of shell script to run. For an incident, enter snow_incident.py For an event, enter snow_event.py Click Save. Please refer to the below document for detailed process https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usescriptedalerts ... View more

Hi , I had answered similar query few days ago. Here is my answer , you can use multiple aggregate functions You can use the same search for these optimization issue. I prefer to write it like this. index=indexname | stats dc(yourfield) count(eval(anotherfield=fieldvalue)) by other field names ... View more

What do you mean, when a file is deleted? A file on an OS? If so what OS, and what auditing do you have for that OS? A file on Splunk? Splunk event data? ... View more

@sabdulkader, As far as I know, there is no direct command in splunk to achieve this. However, if you can onboard the application log into splunk then you should be able to search for specific event ids. for example: I know that in windows application log, event id: 11707 (or 1033) would show the details about the software installed. Similarly, 11724 (or 1034) will also show the software uninstalled. I am not sure about any such direct way in Unix. Maybe you can create a shell script that will pull the user's history and stream into splunk. Then all you will have to do is to search certain keywords like install, uninstall, remove etc.. Does it help? ... View more

Can you send me the the inputs.conf stanza ... View more

Hi , If i am able to answer your query , Can you please mark this answer as accepted ? ... View more