Activity Feed
- Posted Re: Why my windows splunk UF agent is failing frequently on Splunk Enterprise. 08-22-2022 06:14 AM
- Karma Re: splunk DB connect addon for Nith1. 05-11-2022 03:09 AM
- Posted Splunk DB Connect 3.6.0 and MySQL- having trouble with inputs on Getting Data In. 05-11-2022 02:24 AM
- Posted Re: Azure eventhub input error with Splunk Add-on for Microsoft Cloud Services on All Apps and Add-ons. 10-08-2021 10:56 AM
- Posted Re: Azure eventhub input error with Splunk Add-on for Microsoft Cloud Services on All Apps and Add-ons. 09-14-2021 06:13 AM
- Posted Azure eventhub input error with Splunk Add-on for Microsoft Cloud Services on All Apps and Add-ons. 09-08-2021 11:46 PM
- Posted Re: Unable to setup connectivity between splunkDB Connect with Azure Synapse DB on Splunk Enterprise. 09-29-2020 12:59 AM
- Posted Re: Unable to connect splunk to hive using db connect 3.4.0 on All Apps and Add-ons. 09-16-2020 06:47 AM
Topics I've Started
08-22-2022
06:14 AM
Hi! Im having the same issue. Did you get it resolved?
... View more
05-11-2022
02:24 AM
Hi! Im running Splunk DB Connect 3.6.0 on my HF (ver 8.0.9) and having some issues with one of my inputs. Im trying to index licens usage data from Appdynamics into Splunk with the query below. It runs fine in GUI and i can see the results and i dont get any errors completing the input guide. Checked the splunk_app_db_connect_audit_command.log for errors, but it logs "state=success" However, splunk_app_db_connect_job_metrics.log says "read_count=0 write_count=0 error_count=0" this is the only input against mysql. Any ideas?
SELECT usage_host.account_id AS AccountID,
usage_host.host_id AS UniqueHostID,
usage_host.is_fallback_host AS FallbackHost,
usage_host.virtual_cpus AS vCPUcount,
host_leased_units.usageUnits AS AccountHostLeasedUnits,
if(usage_host.is_fallback_host,
usage_lease.account_units,
0) AS AccountLicenseEntityLeasedUnits,
conf_package.id AS AccountLicensePackage,
usage_license_entity.agent_type AS AgentType,
from_unixtime(usage_license_entity.register_date) AS LeaseDate,
usage_allocation_package.allocation_name AS LicenseRule,
from_unixtime((floor(unix_timestamp() / 300) * 300)) AS SnapshotValidAt
FROM usage_lease
JOIN usage_host
ON usage_host.id = usage_lease.usage_host_id
JOIN usage_allocation_package
ON usage_allocation_package.id = usage_lease.usage_allocation_package_id
JOIN usage_license_entity
ON usage_license_entity.id = usage_lease.usage_license_entity_id
JOIN conf_package
ON conf_package.int_id = usage_lease.usage_package_id
JOIN
(SELECT usage_host.host_id,
round(sum(usage_lease.account_units)) AS usageUnits
FROM usage_lease
JOIN usage_host
ON usage_host.id = usage_lease.usage_host_id
WHERE usage_lease.created_date = (floor(unix_timestamp() / 300) * 300)
AND usage_host.account_id = 2
GROUP BY usage_host.host_id) AS host_leased_units
ON host_leased_units.host_id = usage_host.host_id
WHERE (usage_lease.created_date = (floor(unix_timestamp() / 300) * 300)
AND usage_host.account_id = usage_allocation_package.account_id
AND usage_allocation_package.account_id = usage_license_entity.account_id
AND usage_license_entity.account_id = 2)
ORDER BY usage_host.host_id;
... View more
Labels
- Labels:
-
heavy forwarder
-
inputs.conf
10-08-2021
10:56 AM
Hi! Not sure if this helps you but i found a solution that works for me. We ended up sending our azure devops audit logs to a Log Analytics Workspace and from there we are exporting the data to the eventhub. The MS Add-on for Cloud Services was able to fetch the data from the eventhub.
... View more
09-14-2021
06:13 AM
@jconger Thanks! Firewall/Network settings looks fine. However im seeing a lot of the error below: 2021-09-14 15:06:02,025 level=WARNING pid=25855 tid=Thread-1 logger=azure.eventhub._eventprocessor.event_processor pos=event_processor.py:_do_receive:334 | EventProcessor instance 'xxxxx' of xxxx' partition '0' consumer group '$Default'. An error occurred while receiving. The exception is TypeError('list indices must be integers or slices, not str').
... View more
09-08-2021
11:46 PM
Hi, Im using ver 4.1.5 of the cloud services Add-on on my HF Splunk ver 8.0.9. I've configured an Azure App Account in the App and a input for collecting Azure Devops Audit data. But im not getting any logs in to Splunk. Im getting below warning message in "splunk_ta_microsoft_cloudservices_mscs_azure_event_hub_AzureDevopsAudit.log" 2021-09-09 08:22:45,926 level=WARNING pid=84608 tid=Thread-2 logger=uamqp.authentication.cbs_auth pos=cbs_auth.py:handle_token:122 | Authentication Put-Token failed. Retries exhausted. CPU rises to 90% when input is enabled. Any ideas? Regards, Martin
... View more
Labels
- Labels:
-
troubleshooting
09-29-2020
12:59 AM
Hi, Have you tried installing MSAL4J
... View more
09-16-2020
06:47 AM
Ensure that Splunk has necessary permissions on splunk_app_db_connect\windows_x86_64\bin and splunk_app_db_connect\drivers
... View more