I'm using the below mentioned code in java: import com.splunk.*; // The entry point to the client library public class Connection { public static void main(String[] args) { ServiceArgs loginArgs = new ServiceArgs(); loginArgs.setUsername("admin"); loginArgs.setPassword("changeme"); loginArgs.setHost("apl10865gtapp14"); loginArgs.setPort(8089); loginArgs.setScheme("http"); HttpService.setSslSecurityProtocol(SSLSecurityProtocol.TLSv1_2); Service service = Service.connect(loginArgs); for (Application app : service.getApplications().values()) { System.out.println(app.getName()); }}} Below mentioned is the error which I get.... Exception in thread "main" java.lang.RuntimeException: Connection refused: connect at com.splunk.HttpService.send(HttpService.java:409) at com.splunk.Service.send(Service.java:1293) at com.splunk.HttpService.post(HttpService.java:308) at com.splunk.Service.login(Service.java:1122) at com.splunk.Service.login(Service.java:1101) at com.splunk.Service.connect(Service.java:187) at Connection.main(Connection.java:13) Caused by: java.net.ConnectException: Connection refused: connect at java.net.DualStackPlainSocketImpl.connect0(Native Method) at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source) at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source) at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source) at java.net.AbstractPlainSocketImpl.connect(Unknown Source) at java.net.PlainSocketImpl.connect(Unknown Source) at java.net.SocksSocketImpl.connect(Unknown Source) at java.net.Socket.connect(Unknown Source) at java.net.Socket.connect(Unknown Source) at sun.net.NetworkClient.doConnect(Unknown Source) at sun.net.www.http.HttpClient.openServer(Unknown Source) at sun.net.www.http.HttpClient.openServer(Unknown Source) at sun.net.www.http.HttpClient. (Unknown Source) at sun.net.www.http.HttpClient.New(Unknown Source) at sun.net.www.http.HttpClient.New(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.connect(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source) at com.splunk.HttpService.send(HttpService.java:403) ... 6 more Not sure what the problem is..!! Can you guys please help me out on this? ... View more

/getClientProfileV1Request></SOAP-ENV:Body></SOAP-ENV:Envelope></soap-env:Body>-- HTTP Header values -<tp:headers xsi:type="http:HttpRequestHeaders" xmlns:http="http://www.bea.com/wli/sb/transports/http" xmlns:tp="http://www.bea.com/wli/sb/transports" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance&quot;&gt;&lt;tp:user-header name="Authorization" value="Basic cHJvZmlsZXVzZXI6cHJvZmlsM3VzM3I="/><tp:user-header name="EData" value="19=1.2,15=RS-Ro,16=Dn,13=getCtRequest,11=REQ,2=getes,10=3xbhkxv0p9,7=Assigned,6=PCK069,5=getAssignedRoles,4=com,9=roscha3c,8=UNKNOWN,1.2=APP10865:3xbhkxw1kw:3xbhkxxefh,1.1=APP09470::3xbhkxv28o"/><tp:user-header name="Syste" value="RO"/><http:Accept>application/xml</http:Accept><http:Content-Type>text/xml</http:Content-Type></tp:headers> Above is the log in text format inside a text file. I need to index the same in my indexer in XML format itself. what would be the easy way to read the text file and convert it to an XML file so that I can view the logs in xml format in splunk GUI? ... View more

Transport : GoodTransport System : ESS JMS Message ID : ID:414d512042542e51e37d79596dde3421 Queue JNDI Name : MQ_ESRequest Event ID : 31ae5b1#15dbb8ab#-688 Request Send Start Time : Mon Aug 07 08:08:23 2017 Request Send End Time : Mon Aug 07 08:08:23 2017 Status : Success -------------------------------------------REQUEST XML------------------------------------------- 256 lines ------------------------------------------END OF REQUEST----------------------------------------- In the above XML Transport and System fields are split into 1 event, JMS ID Queue and EventID are split into another event and also in the XML there are many splits in between. How should I write the props.conf so that I can get complete xml as a single event..? Also I should modify the props.conf which is present in SPLUNK_HOME/etc/system/local right? Please help guys...! ... View more

$ cd /opt/splunkforwarder/bin $ ./splunk status Couldn't determine $SPLUNK_HOME, perhaps it should be set in environment When ./splunk status command is executed in Splunk Forwarder's bin folder, the above mentioned splunk home error is getting displayed. Please suggest me a way to resolve this issue. Thanks ... View more