I have a very small app that is installed in our Splunk Cloud instance. in props.conf I have [access_combined] REPORT-access_combined = REPORT-extract_app_from_source and in transforms.conf [REPORT-extract_app_from_source] SOURCE_KEY = source REGEX = [regex to extract app attribute] This has been working perfectly to extract the variable app from the source during searches. I have made a separate unrelated update to the app and now I am getting a failure when Splunk Cloud is vetting the app. check_pretrained_sourcetypes_have_only_allowed_transforms - Only TRANSFORMS- or SEDCMD options are allowed for pretrained sourcetypes. What is now the correct way to add these search time attributes? ... View more

I have a working Splunk DB Connect that I am trying to extend. This is on a heavy forwarder that is pushing the data to Splunk Cloud I have created new identities and validated collections, however, when trying to use the new (or old) connections I am now receiving the following error com.splunk.dbx.exception.NotFoundException: Can not find object XXXXXX of type connection. I have found in the logs the following error: 127.0.0.1 - splunk [10/Jan/2020:16:02:11.761 -0800] "GET /servicesNS/admin/-/configs/conf-db_connections/XXXXXX HTTP/1.1" 404 144 - - - 0ms The main user is actually called splunk and when splunk appears in logged urls rather than admin the 404 is replaced by 200 -- Why is the system using admin username during setup but splunk during execution and how do I stop this? ... View more