Hello, I am not getting events from the uptime.sh which gives system date and uptime information via the shell command. This script is a part of Splunk Add-On for Unix and Linux which is installed on the universal forwarder. I am getting data from other inputs like cpu.sh, vmstat.sh, df.sh etc...but not only from uptime.sh. I check the disabled is also set to false and in sync with other stanzas like the stanzas of cpu,vmstat etc. Any insights into if I am missing anything?   ... View more

Hello Guys, Good Day!! Can anyone please help me with a question that I have. Can I use a macro in the event type in Splunk. I am trying but looks like there is some issue.  A very small example, in my eventtype [abcEventType] search = index=`index` and in the query behind my panel I have: eventtype=abcEventType | stats count I am on Splunk on prem version 8.1.0.1 Thanks ... View more

Hello Guys, I am running app-inspect on my add-on and I am encountering one failure which I am unable to resolve. Please find below the failue. Should not it be false-positive? How to deal with this.  { "checks": [ { "description": "Check that the app does not include viruses.", "messages": [ { "code": "reporter.fail(message)", "filename": "check_viruses.py", "line": 41, "message": "An issue was found by ClamAV: A virus was detected by ClamAV: FOUND PUA.Html.Exploit.CVE_2014_0322-1", "result": "failure", "message_filename": null, "message_line": null } ], "name": "check_for_viruses", "tags": [ "splunk_appinspect", "cloud", "antivirus", "private_app" ], "result": "failure" } ], "description": "Malware, viruses, malicious content, user security standards (dynamic checks)", "name": "check_viruses" }   Thanks & Regards, Madhuri ... View more

Hello All, I have a question. I am getting the below warning on all the panels of my dashboard. Also, the search is taking a lot of time to execute. Configuration initialization for /opt/splunk/etc took longer than expected (1953ms) when dispatching a search with search ID _bWFkaHVyaS5tYXlhbmtAcm9qb2NvbnN1bHRhbmN5LmNvbQ_bWFkaHVyaS5tYXlhbmtAcm9qb2NvbnN1bHRhbmN5LmNvbQ__search__search1_1598863806.484277. This usually indicates problems with underlying storage performance. I checked with the disk usage and CPU utilization but that is not an issue here.  I am on version Splunk 7.2.4 (build 8a94541dcfac) Can you please help me to troubleshoot this and how can I get this solved. Thanks, Madhuri ... View more

Hi, I am facing an issue with my add-on in Splunk. When I enable the property requireClientCert = true in server.conf file, the add-on does not launch successfully and the internal log suggests that it is a SSLV3_ALERT_HANDSHAKE_FAILURE. Can someone please let me know if i am missing any configuration?  Thanks!! ... View more