Hi,  just wanted to check,  did you get it to connect to n8n or Claude? Cheers,  Keith  ... View more

Just in case anyone has the same issue as me. My KV store was broken which stopped task server from starting splunkd.log 05-31-2024 01:59:56.804 +0000 ERROR ExecProcessor [1322 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.sh" 01:59:56.804 [main] INFO com.splunk.dbx.utils.SecurityFilesGenerator - Initializing secret kv store collection 05-31-2024 01:59:56.867 +0000 ERROR ExecProcessor [1322 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.sh" 01:59:56.867 [main] INFO com.splunk.dbx.utils.SecurityFilesGenerator - secret KV Store not found, creating mongod.log 2024-05-31T03:20:05.019Z I ACCESS [main] permissions on /opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key are too open Changing the permissions on /opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key to 400 and restarting fixed the issue for me ... View more

Hi Dan. Not sure if you got this sorted. Just check that your $SPLUNK_HOME is set  otherwise on linux try editing /opt/splunk/etc/splunk-launch.conf   ... View more

  OK, 3rd time lucky   [| inputlookup host.csv | table host] `diskspace` | eval host=upper(host) | eval FreeSpace = round(FreeSpaceKB/1024/1024,1) | rangemap field=FreeSpace low=0-30 elevated=31-99 high= 100-200 default=severe | eval FreeSpace = FreeSpace." GB" | append [    | makeresults    | eval _time = 0      | eval host="$tok_filterhost$"     | range="guarded"   | eval NoSpace = "No event for this host"    ] | search host=$tok_filterhost$ | stats latest(FreeSpace) as FreeSpace latest(range) AS range make sure you turn off use colors in the Viz format , adjust your color levels accordingly in the rangemap. low is green, elevated is yellow, severe is red, guarded will be blue.   ... View more

Oh wait , that doesn't actually solve your initial problem does it.......... Gimme 5 mins ... View more

Ah ok, I see what you mean 🙂 Try this - can't really test myself, but it should work.   [| inputlookup host.csv | table host] `diskspace` | eval host=upper(host) | eval FreeSpace = round(FreeSpaceKB/1024/1024,1)." GB" | append [    | makeresults    | eval _time = 0      | eval host="$tok_filterhost$"    | eval FreeSpace = "No event for this host"    ] | search host=$tok_filterhost$ | stats latest(FreeSpace) as FreeSpace by host | table FreeSpace ... View more

Are you using the Single Value visualization for your panel? If so , try removing the eval where you append the GB suffix. Set the color range in the viz format settings, and add the GB as a suffix in the viz format settings.   [| inputlookup host.csv | table host] `diskspace` | fields FreeSpaceKB host | eval host=upper(host) | eval FreeSpace = FreeSpaceKB/1024 | eval FreeSpace = round(FreeSpace/1024,1) | search host=$tok_filterhost$ | stats latest(FreeSpace) as FreeSpace by host | table FreeSpace | appendpipe [| stats count | eval FreeSpace="No event for this host" | where count = 0 | table FreeSpace ]       ... View more

try where instead of search, it's easier to determine if Splunk is looking for an Object_Name with the value FilePath, or if it's looking an Object_Name field with the same value as the FilePath field you created. i.e. where Object_Name==FilePath Otherwise you could use regex  where match(Object_Name,"^C\:\\Finance\\Salary") ... View more

Update on this, I've installed 7.3.5 from scratch with new plain text pass4symmkey and sslpasswords Still get the same error, so there's still more to this than just the hashing I think. I shall persevere and update again if there's any solution ... View more

if you append .gz to the csv file name, it will automatically compress/decompress the resulting lookup file. e.g. | outputlookup lookup.csv becomes | outputlookup lookup.csv.gz Can save a lot of space. Obviously there are caveats. You cannot append to a compressed lookup ... View more

Possibly flogging a dead horse with this. We're looking at autoscaling our HF layer behind an ELB UF -> ELB -> HFs -> IDXs Has anything changed significantly in the last 5 years. Splunk doco still says no, just wondering if anyone was using this in the wild? I'm assuming Splunk Cloud has some version of this setup running? ... View more

Yeah, I think it was a version thing. I downgraded to 7.2.7 and everything worked again properly. Thanks for the info about the hashing algorithm, I'm building a new build for 7.3.5 so it "should" be all fresh and shiny and new and work like a charm straight out of the box ........................................... ... View more

This output was from a curl command to deploy. I get the same error message body when using ./splunk apply shcluster-bundle -target=https://xx.xx.xx.xx:8089 ... View more

Also you should be able to replace this line [ inputlookup TY18_Splunk_total_data.csv WHERE capability=="109X" Sometimes it works, sometimes it doesn't - Yay Splunk ... View more

Hi, You should be able to get the same results without using join (splunk_server=indexer* index=wsi_tax_summary sourcetype=stash capability=109* tax_year=2019 ein=* intuit_offeringid=* partnerId!=*test* partnerId=*) | timechart span=1d dc(intuit_tid) as 19attempts | streamstats sum(19attempts) as 19attempts | eval time=strftime(_time,"%m-%d") | append [ inputlookup TY18_Splunk_total_data.csv | where capability="109X" | stats sum(attempts) as 18attempts by _time | streamstats sum(18attempts) as 18attempts | eval time=strftime(strptime(_time,"%m/%d/%Y"), "%m-%d") | fields time 18attempts] | stats values(19attempts) AS TY19, values(18attempts) AS TY18 by time Cheers, Keith ... View more

Just as an additional option, I use this method to toggle inputs on and off I put the inputs in separate panels to the fieldset <fieldset submitButton="true" autoRun="true"> <input type="time" token="timeToken" searchWhenChanged="true"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="checkbox" token="showFreeText"> <label>Free Text Search</label> <choice value="1">Yes</choice> <change> <condition value="1"> <unset token="showFilters"></unset> </condition> <condition match="isnull(showFreeText)"> <unset token="showFreeText"></unset> <set token="showFilters">foo</set> </condition> </change> </input> </fieldset> <row> <panel depends="$showFilters$"> <input type="dropdown" token="tokenFilter1" searchWhenChanged="true"> <label>Choose field to filter on</label> <fieldForLabel>key</fieldForLabel> <fieldForValue>field</fieldForValue> blah blah </panel> <panel depends="$showFreeText$"> <input type="text" token="tokenFreeSearch" searchWhenChanged="true"> <label>free text Search</label> By using the match isnull(tokenName) it will be true if the check box is UNticked ... View more

Hi @isaor, The retention times are set in indexes.conf https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf For the retention time you set the frozenTimePeriodInSecs This is the example for the cold to frozen retention period. frozenTimePeriodInSecs = <nonnegative integer> * Number of seconds after which indexed data rolls to frozen. * If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen. * IMPORTANT: Every event in the DB must be older than frozenTimePeriodInSecs before it will roll. Then, the DB will be frozen the next time splunkd checks (based on rotatePeriodInSecs attribute). * Highest legal value is 4294967295 * Defaults to 188697600 (6 years). For 1 year, you would set the value to 31556926 seconds ... View more

Hi, I would check your token names, as the "Search is waiting for input... " is sometimes a symptom of a misspelled token in the search. Is there something that's set in the 2nd tab that's used in the 1st? HTH, Keith ... View more

Do you mean you want to ingest the MIBs into Splunk using Anaconda/Python, or collect them with Anaconda/Python and then ingest into Splunk? ... View more

No problem 🙂 ... View more

@hwakonwalk Have you tried using the stack feature in the formatting? This will remove any zero columns. It will work if you only have 1 range per timeslot. Like this ... View more

Best idea would be to save your data as a CSV file. Do an inputlookup for that file and an outputlookup to your kvstore. | inputlookup data.csv | outputlookup kvstore That way you can do any extra ETL either in the CSV file, or between the inputlookup and outputlookup stages ... View more