Hi, I seem to receive warnings like the one below: LineBreakingProcessor [1616 structuredparsing] - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 15230  I used to have similar messages with [313 parsing] in the warning and they disappeared with  [default] TRUNCATE = 20000 The parsing messages ended with the above and I understand the warning will appear with messages longer than 20000 bytes. But it seems like I should adjust something else for the structuredparsing messages. Any suggestions, what would be the right parameter to adjust. ... View more

Hi, We upgraded recently splunk from 9.4.3 to 10.4.3 and it seems like logging in from the Web GUI fails every single time. With 9.4.3 the login worked as expected. The GUI offers a direct link to the error log and the details contain: TimeoutError: The read operation timed out During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/opt/splunk/lib/python3.13/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 343, in handle_exceptions return fn(self, *a, **kw) File "/opt/splunk/lib/python3.13/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 361, in appDispatcher if not self.check_app(app): ~~~~~~~~~~~~~~^^^^^ File "/opt/splunk/lib/python3.13/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 335, in check_app apps = self.getEnabledAppManifest() File "/opt/splunk/lib/python3.13/site-packages/splunk/appserver/mrsparkle/controllers/view.py", line 80, in getEnabledAppManifest return cached.getEntities('apps/local', search=['disabled=false'], count=-1) ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "</opt/splunk/lib/python3.13/site-packages/decorator.py:decorator-gen-4>", line 2, in getEntities File "/opt/splunk/lib/python3.13/site-packages/splunk/appserver/mrsparkle/lib/cached.py", line 140, in dec return helper(fn, *a, **kw) File "/opt/splunk/lib/python3.13/site-packages/splunk/appserver/mrsparkle/lib/cached.py", line 127, in __call__ data = func(*args, **kwargs) File "/opt/splunk/lib/python3.13/site-packages/splunk/appserver/mrsparkle/lib/cached.py", line 158, in getEntities return splunk.entity.getEntities(*args, **kwargs) ~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^ File "/opt/splunk/lib/python3.13/site-packages/splunk/entity.py", line 146, in getEntities atomFeed = _getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs) File "/opt/splunk/lib/python3.13/site-packages/splunk/entity.py", line 240, in _getEntitiesAtomFeed serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/splunk/lib/python3.13/site-packages/splunk/rest/__init__.py", line 660, in simpleRequest raise splunk.SplunkdConnectionException('Error connecting to %s: %s' % (path, str(e))) splunk.SplunkdConnectionException: Splunkd daemon is not responding: ('Error connecting to /services/apps/local: The read operation timed out',)   Sure looks like collecting some entity information fails, and the blame is put on splunkd not responding. Anyone experienced the same and especially, any ideas on how to fix this? ... View more

Hi, I tried to create a summary-event index using collect. The aim was to be able to define some things that the standard way of creating summary indexes does not allow. Specifically I wanted to define the sourcetype, but it had the extremely unwanted property of joining all the events together to one huge event. In my test there were only 5 events to be summary-indexed, so I can't tell what would have happened with a larger amount of events. Anyhow, here is my search (simplified from the real one obviously): index=mydata host=myhosta sourcetype=my_events event="success" NOT ( [search index=sum_mydata sourcetype=my_events_summary event="success" | append [makeresults | eval id="_NoneFound_" ] | return 100000 id ] ) | collect index=sum_mydata testmode=false host="myhost" marker="node=a" sourcetype=my_events_summary So it is a simple search trying to find events meeting certain criteria and trying to avoid indexing the same event twice. Running with testmode=true this works like a dream. Moreover, on the indexer I have defined in props.conf the following: [my_events_summary] TIME_FORMAT = %F\ %T(,|.)%3N%z NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = true This is the same definition I have for my_events on the host running UF to send the events. Now, just commenting out the sourcetype=my_events_summary makes the data flow to the summary index, but having this definition added, all the five events I am testing with are lumped together. Why? ... View more

Hi, We upgraded our Splunk from 9.4.3 to 10.4.3 and it seems like something changed. The following used to work without any problems: curl -s -k "https://foo:[email protected]:8089/services/search/jobs/export?output_mode=json&search=savedsearch%20mysearch" Now the response I get from the server is {"messages":[{"type":"FATAL","text":"The method is not allowed."}]} For comparison, I tried by removing the username and password from the curl, and the response was {"messages":[{"type":"ERROR","text":"Unauthorized"}]} I deduce from this that foo manages to authenticate to the server, but it is unclear to me what is not allowed? And whatever it is, it used to be allowed up to the point of upgrading the server version.  I could find from the logs that my request received a response with status code 405, but no clarity to what exactly is not allowed. Any ideas? Thanks! ... View more

Hi, I have a pretty long search I want to be able to utilize as a savedsearch and allow others benefit from one shared search and maybe mutually edit the search, if need be. There is a part in the search utilizing a structure   search index=ix2 eventStatus="Successful" | localize timeafter=0m timebefore=1m | map search="search index=ix1 starttimeu=$starttime$ endtimeu=$endtime$ ( [ search index=ix2 eventStatus="Successful" | return 1000 eventID ] ) | stats values(client) values(port) values(target) by eventID   This is a simplified extraction of what I am really doing, but the search works fine when run as a plain direct search from the GUI. If I save it and try using it with   |savedsearch "my-savedsearch"   I get the error Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'my-savedsearch': Error while replacing variable name='starttime'. Could not find variable in the argument map. It looks like the $starttime$ and $endtime$ cause trouble, but what can I do to come around? I want to have this stuff in a saved search to avoid operating with a long search all the time in the browser. also, it is essential to use the localize - map construction, because otherwise I am not able to run this search for long time windows and I would really like to be able to do it. There was a ticket by @neerajs_81 about pretty much the same issue, but there were no details about the saved search and above all, there seemed not to be a solution. ... View more

Hi! I have an environment with a single indexer+srchead and approximately 100 UFs sending logs to it. Some of them are quite active log producers. I have realized that invoking a splunk restart to activate a config change will usually cause data loss for a period of 1-2 minutes for some of the sources, which is something  I would rather avoid. It should be doable by stopping the UFs first, then restarting the indexer and finally starting the UFs again. Is there another way? I figure the data originating from log files monitored by UFs gets sent to the indexer, but the poor indexers don't know the indexer is unable to process the last bits and the UF thinks the data was properly received and processed. I read about Persistent Queues, but that didn't quite seem to solve this issue either. Any suggestions? ... View more