Sorry. I may have jumped to conclusion too quickly. It doesn't seem to work still! Any new alerts created still takes splunk@host instead of splunk@domain. The console and the alerts_actions.conf settings are the same. The user 'splunk' has full read/write permissions 600 on the file and runs this application as the 'splunk' user. ... View more

This seems to work on the search query. So the route for email delivery is clear. It doesn't work if you specify on the configuration files. ... View more

Thanks. I did got through the link earlier. Our Splunk sends out the email through a Postfix mail server so we can clearly see that Splunk is setting the email from field to splunk@host instead of splunk@domain from its mail logs. This makes us believe it is a Splunk issue. ... View more

Thanks! This is a good idea. I will follow this if nothing else works. ... View more

Thanks for your response. In your opinion what is the best way to break this XML file so that we can construct a table with [Date] [SOA_Cable_ID] [Created_by] The problem with the XML is there are multiple tags for Soa_cable_id, dates etc.. that we are not able to discern how to create the report. ... View more

Thank you for your response. We are now looking at selecting the whole block of XML code instead of breaking it by time stamp. See my response below to woodcock. Thank you again. ... View more

Thanks! I have a variation to the above question as we found out this further complicates matters on extraction. From the below code, can we force splunk to ignore the timestamps and select the whole block (start to end)? We would then run a xmlkv | table soa_cable_id etc.. to make a report. 2016-05-26 10:14:37 | R.R.services.section_B_C.save.saveSection_B_C | [I] | <?xml version="1.0"?> <subsidary_id>1014</subsidary_id> <is_first_filling>false</is_first_filling> <system_id>8323</system_id> <updated_by>[email protected]</updated_by> <created_by>[email protected]</created_by> 2016-05-26 10:14:49 | R.R.services.section_A_K_N.save.saveSection_A_K_N | [I] | <?xml version="1.0"?> <soa_cable_id>4917</soa_cable_id> <accounting_period_id>1008</accounting_period_id> <gross_recipts>8233</gross_recipts> <contact_person_id>1095</contact_person_id> <user_name>[email protected]</user_name> <form_type_id>1079</form_type_id> <form_type_value>short</form_type_value> 2016-05-26 10:14:58 | R.R.services.section_D.save.saveSection_D | [I] | <?xml version="1.0"?> <community> <soa_city_id/> <soa_cable_id/> <is_first_community>true</is_first_community> <soa_city_name>vienna</soa_city_name> <county></county> <state_id>1001</state_id> <state> <state_id/> <state_name/> <country> <country_id/> <country_name/> <updated_by/> <updated_date/> <created_by/> <created_date/> </country> <country_id/> <updated_by/> <updated_date/> <created_by/> <created_date/> </state> <created_by/> </community> <soa_cable_id>4917</soa_cable_id> <user_name>[email protected]</user_name> 2016-05-26 10:15:03 | R.R.services.section_E.save.saveSection_E | [I] | <?xml version="1.0"?> <soa_cable_id>4917</soa_cable_id> <user_name>[email protected]</user_name> <secTransmissionTV> <res_svc_first_set_no_subscribers>8</res_svc_first_set_no_subscribers> <res_svc_first_set_no_rate>3243</res_svc_first_set_no_rate> <res_svc_addl_sets_no_subscribers></res_svc_addl_sets_no_subscribers> <res_svc_addl_sets_no_rate></res_svc_addl_sets_no_rate> <res_fm_no_subscribers></res_fm_no_subscribers> <res_fm_no_rate></res_fm_no_rate> <motel_hotel_subscribers></motel_hotel_subscribers> <motel_hotel_rate></motel_hotel_rate> <commercial_subscribers></commercial_subscribers> <commercial_rate></commercial_rate> <converter_subscribers/> <converter_rate/> <converter_resid_subscribers></converter_resid_subscribers> <converter_resid_rate></converter_resid_rate> <converter_non_resid_subscriber></converter_non_resid_subscriber> <converter_non_resid_rate></converter_non_resid_rate> <updated_by/> <updated_date/> <created_by/> <created_date/> </secTransmissionTV> 2016-05-26 10:15:05 | R.R.services.section_F.save.saveSection_F | [I] | <?xml version="1.0"?> <soa_cable_id>4917</soa_cable_id> <user_name>[email protected]</user_name> <otherSecTransmissionTV> <soa_cable_id/> <cont_svcs_pay_cable></cont_svcs_pay_cable> <cont_svcs_pay_cablepay_cable_addl_channel></cont_svcs_pay_cablepay_cable_addl_channel> <cont_svcs_fire_protection></cont_svcs_fire_protection> <cont_svcs_burglar_protection></cont_svcs_burglar_protection> <install_resi_first_set></install_resi_first_set> <install_resi_addl_set></install_resi_addl_set> <install_resi_fm_radio></install_resi_fm_radio> <install_resi_converter></install_resi_converter> <install_non_resi_motel></install_non_resi_motel> <install_non_resi_commercial></install_non_resi_commercial> <install_non_resi_pay_cable></install_non_resi_pay_cable> <install_non_resi_pay_cable_addl_channel></install_non_resi_pay_cable_addl_channel> <install_non_resi_fire_protection></install_non_resi_fire_protection> <install_non_resi_burglar_protection></install_non_resi_burglar_protection> <othr_svcs_reconnect></othr_svcs_reconnect> <othr_svcs_disconnect></othr_svcs_disconnect> <othr_svcs_outlet_relocation></othr_svcs_outlet_relocation> <othr_svcs_move_to_new_addr></othr_svcs_move_to_new_addr> <updated_by/> <updated_date/> <created_by/> <created_date/> </otherSecTransmissionTV> 2016-05-26 10:15:19 | R.R.services.section_I.save.saveSection_I | [I] | <?xml version="1.0"?> <soa_user_id>4917</soa_user_id> <user_name>[email protected]</user_name> <non_network_substitute_channels>false</non_network_substitute_channels> 2016-05-26 10:15:21 | R.R.services.section_L.save.saveSection_L | [I] | <?xml version="1.0"?> <soa_user_id>4917</soa_user_id> <user_name>[email protected]</user_name> <royaltyFee> <soa_cable_id>4917</soa_cable_id> <accounting_period_id>1008</accounting_period_id> <gross_receipts>8233.00</gross_receipts> <fee>67.0</fee> <interest_amount>0.00</interest_amount> <filing_fee>15.00</filing_fee> <total_royalty_fee>67.00</total_royalty_fee> <form_type_id>1079</form_type_id> <is_partial_distant></is_partial_distant> <has_distant></has_distant> <submitted_date/> <shortform> <block1_1>52.00</block1_1> <block1_2/> <block2_1/> <block2_3/> <block2_5/> <block2_6/> <block2_7/> <block2_8/> <block2_9/> <block3_2/> <block3_3/> <block3_4/> <block3_5/> <block3_6/> <block3_7/> </shortform> <longform/> <interestAssesment> <late_payment_amount>52.00</late_payment_amount> <interest_rate></interest_rate> <no_of_days_late>0</no_of_days_late> <sectionQ_line2>0.00</sectionQ_line2> <sectionQ_line3>0.00</sectionQ_line3> <interest_amount>0.00</interest_amount> </interestAssesment> </royaltyFee> 2016-05-26 10:15:25 | R.R.services.section_M.save.saveSection_M | [I] | <?xml version="1.0"?> <soa_user_id>4917</soa_user_id> <total_number_of_channels>1</total_number_of_channels> <activated_channel_count>2</activated_channel_count> <user_name>[email protected]</user_name> 2016-05-26 10:15:25 | R.R.services.section_M.save.saveSection_M | [I] | <?xml version="1.0"?> <soa_user_id>4917</soa_user_id> <total_number_of_channels>1</total_number_of_channels> <activated_channel_count>2</activated_channel_count> <user_name>[email protected]</user_name> 2016-05-26 10:15:27 | R.R.services.section_P.save.saveSection_P | [I] | <?xml version="1.0"?> <soa_user_id>4917</soa_user_id> <is_secondary_transmission_satellite>false</is_secondary_transmission_satellite> <satellite_gross_recipts></satellite_gross_recipts> <user_name>[email protected]</user_name> 2016-05-26 10:15:34 | R.R.services.section_O.save.saveSection_O | [I] | <?xml version="1.0"?> <certified> <certified_by_type_id>1041</certified_by_type_id> <user_id>1095</user_id> <user_name>[email protected]</user_name> <soa_cable_id>4917</soa_cable_id> </certified> ... View more

Thank you Chris. I'm sure this is the right way to do it although I wasn't able to see my logs i uploaded. The workaround I was to generate a one line script to direct all the log files and collate to one big file and upload it. I'm able to see the data now. Thank you! ... View more

I uploaded a directory named /usr/local/splunk/temp/06/04 that has about 20 files of 1 KB each. After clicking Index once and taking the defaults and doing the search, I get no results, This is on my search bar, source="/usr/local/splunk/temp/06/04/*" HOST="Hostname" I don't see any output. ... View more

Do we need to refresh something? I'm not able to see the data I've uploaded once I've followed your steps. ... View more

Re-creating the setup resolved this issue for me. I'm guessing there was a mis-step some where while doing the configuration. Thanks! ... View more

I've installed s3sync on the Splunk box which would sync buckets (hot/warm/cold) to the S3 storage. ... View more

The issue was due to populating IAM credentials instead of using SES credentials. This is very easy to overlook and a bit confusing on the AWS side. Thanks for everybody's help! ... View more

Thanks! I will wait on what others have to say on this. ... View more

When I do a index=msad, i do see data in it. host = hostname source = Powershell sourcetype = MSAD:NT5:DNS-Zone-Information 4/15/15 7:59:01.000 AM System.Collections.ArrayList host = hostname source = Powershell sourcetype = MSAD:NT5:DNS-Zone-Information 4/15/15 7:58:52.409 AM wWWHomePage=OptionalProperties host = hostname source = ActiveDirectory sourcetype = ActiveDirectory However, when I do a Guided Setup, under Tools and Settings, I see these errors, ` Data from Splunk Add-on for Microsoft Windows Active Directory Critical data could not be found OK: 10 or more events detected in the last 24 hours ERROR: Search "sourcetype="MSAD*" | head 5" did not return any events in the last 24 hours ERROR: Search "sourcetype="ActiveDirectory*" | head 5" did not return any events in the last 24 hours` So I think there is data but its not going to the right index? ... View more

Thanks for the detailed response. The links are of super help. ... View more

Many thanks to the link to the app and the command. ... View more

Thanks for these links, I got the following configured, My maxDataSize = auto What is the auto setting? maxWarmDBCount = 300 ; so that means I can have 300 warm buckets before it is moved to frozen by default My maxTotalDataSizeMB = 500000 ; I'm assuming this is not equal to maxDataSize ... View more

Thanks. This is interesting data. ... View more