I was looking for this answer! This worked for me,  I have a Mac. ... View more

There is NO Edit Login and Email subscriptions option in My Dashboards. ... View more

UPDATE: After further debugging the reason for milliseconds not appear was very simple: I was using a transforms.conf in the indexer with the format: DEST_KEY = _meta Changed it to WRITE_META = true and all fine no need to force local processing anymore. You may still read below for awareness... Dear mglauser_splunk I recently had an issue parsing milliseconds on sourcetypes that my team had created and were not a default. Milliseconds did not got parsed at all. I tried a lot of setups on indexers and forwarders even changed date_time.xml and tried to train command (deprecated) with no sucess. Splunk Enterprise Version: 7.1.0 Build: 2e75b3406c5b Source file: source::/var/log/springboot/dailyLogFile.log Mask: [INFO ] 2019-02-01 11:02:13.178 ... After trying for a couple of hours to get miliseconds parsed correctly the solution I found was to set on the Splunk Universal Forwarders property force_local_processing to true on /opt/splunkforward/system/local/props.conf [source::/var/log/springboot/dailyLogFile.log] # 2019-02-01 11:02:13.178 # TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N -> It was proven not needed as datetime.xml seems to cover it ??? # TIME_PREFIX=^\[\w*\s*\]\s -> It was proven not needed as datetime.xml seems to cover it ??? force_local_processing=true You need to restart Splunk Universal Forwarder to changes to take place: /opt/splunkforwarder/bin/splunk restart As I mentioned I tried to configure the setting at the indexers level using multiple configuration without sucess. Ultimatly I found this property, force_local_processing at in https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Propsconf This was the only way I got milliseconds to be ingested. Any ideia why ? ... View more

Hi @jmajumdar - Looks like you got some great answers; did they help you to understand how this app works? If so, don't forget to resolve this post by clicking "Accept" below the best answer and up voting. If not, please provide a comment with more information. Thank you! ... View more

Making progress... I can now access the OVA front end and have configured the add-on. However, when I provide VCenter credentials, I get green on VC Credential Validation, but red on Collecting from. "Error getting host list from server" Thanks ... View more

Hello, There are sometimes issues with a direct extraction into the etc/apps folder. Could you try downloading the app into a tmp folder and performing the extraction there? Once extracted, copy and paste the pap contents into the etc/apps folder. ... View more

Hello, The Splunk Mobile App does support direct notifications, even if your Splunk server is behind a proxy. It does require installation of the Splunk Add-on for Mobile Access. Once you have installed the Splunk Add-on for Mobile Access, follow the notification configuration steps here: http://docs.splunk.com/Documentation/MobileAddon/2.3.0/Install/Configurenetwork These steps do however require internet access in order to work. So unless you have any way of staying connected to the internet, you won't be able to receive notifications. ... View more

Hello, The previous answer was relevant for an older Splunk Mobile App release that still used the Mobile Access Server. The Mobile Access server has been deprecated in favor of the Splunk Add-on for Mobile Access. There have been changes in the host formatting. Depending on whether you're using SSO, non-SSO or a DMZ/proxy, login is slightly different. You can read more under the "Log in using Splunk platform credentials" section of the Splunk Mobile App documentation: http://docs.splunk.com/Documentation/MobileApp/2.3.0/Install/Login ... View more