You also need to give permission to the splunk user to write to the volumes you are writing to on the indexer, i.e. if you have a /hot and /cold volume on the indexer, the splunk user needs to have ownership and permissions to write to these volumes. ... View more

Hi, I came accross this old question via google search on alert on splunk-control-group topic. As there is not much information in docs and answers, it might be still relevant. Did you specify action.hipchat.param.color in apps/README/alert_actions.conf.spec file as <boolean>? If so, you can change it to <string> and see, if it makes a difference? Best regards ... View more

This is how I took care of a similar issue: 1. I ran a search on the SH:     index=my_index sourcetype=my_sourcetype | delete 2. After confirming that the records have been delete, I went to the HF - stopped Splunk -  /opt/splunk/bin/splunk cmd btprobe -d /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/ --file /my_file_path/filename.fileextension --reset - restarted Splunk and was able to see new data in SH ... View more

Can you explain this query...the logic etc ... View more

I have this issue across thousands of local.meta files in v8.0.3. Was the issue reintroduced. ... View more

This is an endorsement by a Cribl employee. As a previous user of Cribl, I would not recommend it. ... View more

I think best idea is to file a case at Splunk support to receive the most current beta version of props/transforms. Or to wait for version 3.0.1 of the Add-On. Best regards ... View more

We opened a case for this (1165853) and there is a solution: You can build a custom role to not need a user to have admin_all_objects capability. Step 1: Define a new capability and assign it to a role - via authorize.conf [capability::deployer_capability] [role_deployer] deployer_capability = enabled Step 2: Assign the capability to the correct REST endpoint, which is used by this CLI command - via restmap.conf [apps-deploy:apps-deploy] capability.post=deployer_capability This is working pretty fine for us and we can now have a techical user doing a "splunk apply shcluster-bundle" without having a technical user with admin priviliges. ... View more

We opened a case for this problem (1175734). There is a quite simple workaroud for this (if you know about it): Just add the following code to etc/system/local/restmap.conf: [eai:conf-transforms] capability.write=allow_access_to_all But the problem is also filed as a bug: SPL-162527 ... View more

For those who come to this page looking for an answer how to avoid giving a user admin_all_objects capability, if you only want the user to do a "splunk apply shcluster-bundle"... We opened a case for this (1165853) and there is a solution: You can build a custom role for this. Step 1: Define a new capability and assign it to a role - via authorize.conf [capability::deployer_capability] [role_deployer] deployer_capability = enabled Step 2: Assign the capability to the correct REST endpoint, which is used by this CLI command - via restmap.conf [apps-deploy:apps-deploy] capability.post=deployer_capability This is working pretty fine for us and we can now have a techical user doing a "splunk apply shcluster-bundle" without having a technical user with admin priviliges. ... View more

We opened a case for this (1165853) and there is a solution: You can build a custom role to not need a user to have admin_all_objects capability. Step 1: Define a new capability and assign it to a role - via authorize.conf [capability::deployer_capability] [role_deployer] deployer_capability = enabled Step 2: Assign the capability to the correct REST endpoint, which is used by this CLI command - via restmap.conf [apps-deploy:apps-deploy] capability.post=deployer_capability This is working pretty fine for us and we can now have a techical user doing a "splunk apply shcluster-bundle" without having a technical user with admin priviliges. ... View more

More details on how to managed logs for _internal . The _internal index are populated by the following stanzas: $SPLUNK_HOME/etc/default/inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk] [monitor://$SPLUNK_HOME/etc/splunk.version] $SPLUNK_HOME/apps/SplunkUniversalForwarder/default/inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log] [monitor://$SPLUNK_HOME/var/log/splunk/metrics.log] If we want to forward the logs only to "prod-group" then create the following in $SPLUNK_HOME/etc/system/local/inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk] _TCP_ROUTING = prod-group [monitor://$SPLUNK_HOME/etc/splunk.version] _TCP_ROUTING = prod-group [monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log] _TCP_ROUTING = prod-group [monitor://$SPLUNK_HOME/var/log/splunk/metrics.log] _TCP_ROUTING = prod-group ... View more

Did you try the TERM() keyword? The magic behind it is described in this session for example: Indexed Tokens and you I was able to greatly improve searches for single IP addresses with TERM(). It's working even better when the logs you are searching in do not have quotes (") around the value of dest_ip and have field=value in the _raw data. Because you can then do something like TERM(dest_ip=192.168.1.1). You can even use the inputlookup @masonmorales suggested, when you know how to format the output of a subsearch: index=network sourcetype=fgt_traffic [|inputlookup match_address | eval search="TERM(".match_address.") OR " | stats values(search) as search | nomv search | eval search="(".rtrim(search, " OR ").")"] Edit: Insert " OR " between terms. ... View more

Hi, Is this bug resolved? If yes, in which version? Thanks. ... View more

According to our documentation, AIX is not supported. Has this changed in Version 8.x ? Until 7.3.5 the documentation is listing the supported versions. Beginning with 8.0.0 it revers to the Supported Operating Systems, which includes AIX as suppported for Universal Forwarder: http://docs.splunk.com/Documentation/Splunk/8.0.0/Installation/Systemrequirements#Supported_Operating_Systems ... View more

Exactly what i already built. Very useful. You can also recycle some stuff of the original datetime.xml ... View more

My colleague Johannes @jeffland had a similar issue, and provides a working solution here: https://answers.splunk.com/answers/312173/how-can-i-anonymize-fields-of-data-that-has-underg.html The approach of modifying _meta directly should help you with looking for a pattern in varying fields. ... View more

I had the same issue on Splunk 6.4.4 and had to make sure, that the metadata/default.meta included not only the permission for the lookup. I simply added: [] access = read : [ * ], write : [ * ] export = system ... View more

There's a Java 1.8 issue with DB Connect 2 that requires you to pre-format date/time in the query. With MySQL it's DATE_FORMAT(date_column_name, '%Y%m%d') as date_column_name, for an example. ... View more

if you have used the default usernames and paths you should be able run: sudo -u splunk /opt/splunk/bin/splunk list forward-server ... View more

I took Martins approach and changed it a little. Now you can: (a) use the pixel unit ( myidname_setWidth_200px) (b) remove the width property of a panel (myidname_none) (c) use "percent" as default unit (myidname_setWidth_30 OR myidname_setWidth_30_percent) (d) fill up the remaining space of fixed panels (panel1_setWidth_300px and panel2_setWidth_fill_300) require(['jquery', 'splunkjs/mvc/simplexml/ready!'], function($) { $("[id*=setWidth]").each(function() { var match = /setWidth_(\d+)?(_)?(percent|px|pixel|none|fill)?(_)?(\d+)?(_)?(left|right)?/.exec($(this).attr('id')); console.log("matches\nmatch 1: "+match[1]+"\nmatch 2: "+match[2]+"\nmatch 3:"+match[3]+"\n"); if (match[1]) { if (match[3] == 'percent' || match[3] == '') { $(this).closest(".dashboard-cell").css('width', match[1]+'%'); } else if (match[3] == 'px' || match[3] == 'pixel') { $(this).closest(".dashboard-cell").css('width', match[1]+'px'); } } else if (match[3] == 'none') { $(this).closest(".dashboard-cell").css('width', ''); } else if (match[3] == 'fill') { if (match[5]) { $(this).closest(".dashboard-cell").css('width', 'calc(100% - '+match[5]+'px)'); } } }); $(window).trigger('resize'); }); ... View more

I opened a case and it's confirmed, that the ER was not implemented by now. Our need is now added to ER SPL-175134, but no big hope for having this implemented soon. ... View more

I left this question unchecked for long tims, as the time can be parsed correctly... ... View more

Hi, I have the same problem with rotated logfiles. I'm using Universal Forwarder in version 6.4.5 to monitor a log file and it's rotated versions. There was a network outage and the UF was not able to send it's data for some time. In the meanwhile the logs were rotated and zipped. The files it never began to read were read fine after the Network problem was resolved - even the zipped ones. But the file it was reading at the beginning of the outage was only unzipped and then commented with "already read, so skipped". When I manually unpacked the file and put it in place the UF started reading where it stopped because of the outage. So I think UF is skipping the check of the seekCRC at seekAdress as mentioned here: https://docs.splunk.com/Documentation/Splunk/6.4.5/Data/HowLogFileRotationIsHandled Does anyone know, if this is resolved in any Version? ... View more