multiple UFs on single machine will be supported from Splunk.  ... View more

Hi All, One of our indexer is going down very frequently and i have observed this below error in the dmesg logs  Out of memory: Kill process 20910 (splunkd) score 801 or sacrifice child  Killed process 20914 (splunkd) total-vm:86320kB, anon-rss:9872kB, file-rss:0kB, shmem-res:0kB  splunkd: page allocation failure: order:2, mode:0x35600d0  CPU: 2 PID: 20914 Comm: splunkd Not tainted 3.10.0-693.11.6.el7.x86_64 #1 Can you please help me on this issue Thank you ... View more

We are getting some vulnerabilities for our splunk instance and to fix that we need to Add strict-transport-security header to the http responses. We have tried adding stanza "sendStrictTransportSecurityHeader = true" to the server.conf and web.conf but the issue still persist, Can anyone please help me on this issue ... View more

Hi All,   We are trying to push the props and transforms config files from Cluster Master to all indexers. Source types are visible but the rules are not applied from the config files. Please assist on this issue. Thanks in Advance. ... View more

Hi All, We are trying to install snow with Splunk using latest version of Splunk Add-on for ServiceNow and we are getting the below error. We are trying to integrate snow with Splunk using latest version of Splunk Add-on for ServiceNow Heavy forwarder version: 8.1 Service now Addon:7.1   error: file=splunk_ta_snow_account_validation.py:validate:110 | Unable to reach ServiceNow instance at https://XXXX.service-now.com. The reason for failure is=Traceback (most recent call last): File "/splunk/etc/apps/Splunk_TA_snow/bin/splunk_ta_snow_account_validation.py", line 106, in validate resp, content = http.request(url) File "/splunk/etc/apps/Splunk_TA_snow/lib/httplib2/__init__.py", line 1709, in request conn, authority, uri, request_uri, method, body, headers, redirections, cachekey, File "/splunk/etc/apps/Splunk_TA_snow/lib/httplib2/__init__.py", line 1424, in _request (response, content) = self._conn_request(conn, request_uri, method, body, headers) File "/splunk/etc/apps/Splunk_TA_snow/lib/httplib2/__init__.py", line 1346, in _conn_request conn.connect() File "/splunk/etc/apps/Splunk_TA_snow/lib/httplib2/__init__.py", line 1138, in connect self.sock = self._context.wrap_socket(sock, server_hostname=self.host) File ... View more

How to change a span of 1 week time to start from Monday to friday   usually span=1w it will show data from monday 00:00 hrs to Sunday 23.59 hrs   Can someone help on this query    Thanks in Advance ... View more

i want to extract this below event from the _raw event for all the entries in query. Can you please help me on this.  None, 'Users': [{'Id': '10'}]   Thanks in Advance ... View more

how to reduce the index size of KV store and summary db on the server ... View more

How to restrict the Application Permission in the Splunk UI.  Eg: i just want to give the access only to the particular Application and he can see only that application. is it possible ... View more