Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Muwafi
Muwafi
Path Finder
Member since:
10-24-2017
09-10-2025
Community Statistics
| Posts | 25 |
| Solutions | 1 |
| Karma Given | 26 |
| Karma Received | 2 |
| Member Since | 10-24-2017 |
Activity Feed
- Karma Re: Help with CSV - Special Case for venkatasri. 08-04-2025 01:28 AM
- Posted Re: KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log fo on Installation. 06-11-2022 07:19 PM
- Posted Re: Why did our Splunk DB connect 380 fail to start Task server on Linux machine? on Deployment Architecture. 03-22-2022 05:32 AM
- Posted Re: Why did our Splunk DB connect 380 fail to start Task server on Linux machine? on Deployment Architecture. 03-21-2022 04:25 AM
- Posted Re: Why did our Splunk DB connect 380 fail to start Task server on Linux machine? on Deployment Architecture. 03-21-2022 04:23 AM
- Posted Re: Why did our Splunk DB connect 380 fail to start Task server on Linux machine? on Deployment Architecture. 03-21-2022 04:18 AM
- Posted Why did our Splunk DB connect 380 fail to start Task server on Linux machine? on Deployment Architecture. 03-13-2022 06:39 AM
- Tagged Why did our Splunk DB connect 380 fail to start Task server on Linux machine? on Deployment Architecture. 03-13-2022 06:39 AM
- Tagged Why did our Splunk DB connect 380 fail to start Task server on Linux machine? on Deployment Architecture. 03-13-2022 06:39 AM
- Karma Can I rename a user without deleting and recreating the user? for HeL42. 04-12-2021 03:19 AM
- Posted Re: Help with CSV - Special Case on Splunk Search. 03-18-2021 10:24 PM
- Posted Help with CSV - Special Case on Splunk Search. 03-17-2021 10:24 AM
- Tagged Help with CSV - Special Case on Splunk Search. 03-17-2021 10:24 AM
- Tagged Help with CSV - Special Case on Splunk Search. 03-17-2021 10:24 AM
- Tagged Help with CSV - Special Case on Splunk Search. 03-17-2021 10:24 AM
- Tagged Help with CSV - Special Case on Splunk Search. 03-17-2021 10:24 AM
- Tagged Help with CSV - Special Case on Splunk Search. 03-17-2021 10:24 AM
- Karma How to hide search and inpsect links from all panels? for tdoSplunk. 06-05-2020 12:51 AM
- Got Karma for Error while creating new DB connection to MSQL Server using DB Connect 3.3 "There was an error processing your request. It has been logged". 06-05-2020 12:51 AM
- Karma Highlight multiple chart lines for paul_thomas_bb. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
06-11-2022
07:19 PM
Hello @rayar , have you solved this issue ? if so, would you please update us and post the solution here? Thanks
... View more
03-22-2022
05:32 AM
Hello Splunkers, Thanks for everyone tried to help here. in my case, issue was solved after user permissions was updated to R/W/X for the path /opt/splunk/etc/apps/splunk_app_db_connect/*.* so splunk would be able to run server.sh script Now task server is able to be restarted.
... View more
03-21-2022
04:25 AM
User is already granted the access to java command and is able to run java commands, however issue is still persist.
... View more
03-21-2022
04:23 AM
Yes I have already done that.
... View more
03-21-2022
04:18 AM
I have tried however it didn't work, do Splunk user have to have full access/privilege to the path “/usr/lib/jvm/<JRE or JDK Home Folder>” to be able to restart the task server ?
... View more
03-13-2022
06:39 AM
Hello Splunkers,
I need urgent help on how to fix the below issue
I need to configure splunk DB connect to be able to connect to MSSQL later. Splunk is installed on CentOS 7 and I have installed the JRE and the path is (/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.322.b06-1.el7_9.x86_64/jre/) however I still can't start the Task server and keeps failing.
I have restarted Splunk and the VM itself and issue still persist.
... View more
03-18-2021
10:24 PM
Thanks @venkatasri for your collaboration to help. Will try to configure it and let you know how it worked 😄
... View more
03-17-2021
10:24 AM
Hello Splunkers! We have a situation here and need your help and experience. We are looking for best practice to work with Large CSV files (1Million Rows at least) to produce fast searches and fast dashboards. The case is also special as these CSV files is updated daily on the below manner: It's a daily generated report from another system and this is the only why to send data to Splunk. It could have modification as (new Rows with new data/ new modified values of old data/ OR Full Remove of some Rows) So, we need to update Splunk daily on the change of the files. The only was I can see is to remove the index data and re-index the CSV files everyday! I don't know actually how to do that if we need to automate the whole process or if there is a best practice better than this approach. Appreciate your help.😊
... View more
05-14-2020
07:38 PM
I have fields as shown below:
_time field1 field2
2020-05-12 40-35-32 A-B-C
2020-05-13 63-28-74 A-B-C
need to change the events to be:
_time field1 field2
2020-05-12 40 A
2020-05-12 35 B
2020-05-12 32 C
2020-05-13 63 A
2020-05-13 28 B
2020-05-13 74 C
Appreciate your help fellows Splunkers 😄
... View more
05-06-2020
07:30 AM
Thanks , I changed the Latest Time to "now" and it's working.
... View more
05-04-2020
06:47 PM
Hello @woodcock, you are a wonderful Splunker. I wanna thank you for all efforts you are providing here.
Regarding the $job.latestTime$ token , in case if you are choosing the preset time "All Time" from the Time Picker, the value is of the token will be null or "NaN".
So how to add a condition using eval if to force it to be eqal to now() in such case?
... View more
04-04-2020
02:26 PM
1 Karma
Hello,
This is Urgent.
I am trying to connect to MSQL DB to ingest the data and build my Splunk index.
When I am trying to create new connection I am getting this error: "There was an error processing your request. It has been logged (ID XXXXXXXXX"
Error details from Logs:
2020-04-04 23:41:02.823 +0300 [dw-59 - GET /api/connections/SysAdminSQLDBConnect/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: 33f91cc929c63cfd
java.lang.NullPointerException: null
at com.splunk.dbx.connector.logger.AuditLogger.replace(AuditLogger.java:50)
at com.splunk.dbx.connector.logger.AuditLogger.error(AuditLogger.java:44)
at com.splunk.dbx.server.api.service.database.impl.DatabaseMetadataServiceImpl.getStatus(DatabaseMetadataServiceImpl.java:159)
at com.splunk.dbx.server.api.service.database.impl.DatabaseMetadataServiceImpl.getConnectionStatus(DatabaseMetadataServiceImpl.java:102)
at com.splunk.dbx.server.api.resource.ConnectionResource.getConnectionStatus(ConnectionResource.java:60)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:124)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:167)
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:79)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:469)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:391)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:80)
at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:253)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265)
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:232)
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:680)
at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:392)
at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:346)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:365)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:318)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:205)
at io.dropwizard.jetty.NonblockingServletHolder.handle(NonblockingServletHolder.java:50)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1617)
at io.dropwizard.servlets.ThreadNameFilter.doFilter(ThreadNameFilter.java:35)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.handle(AllowedMethodsFilter.java:47)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.doFilter(AllowedMethodsFilter.java:41)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
at com.splunk.dbx.server.api.filter.ResponseHeaderFilter.doFilter(ResponseHeaderFilter.java:30)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:545)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1297)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:485)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1212)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.java:249)
at io.dropwizard.jetty.RoutingHandler.handle(RoutingHandler.java:52)
at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:767)
at org.eclipse.jetty.server.handler.RequestLogHandler.handle(RequestLogHandler.java:54)
at org.eclipse.jetty.server.handler.StatisticsHandler.handle(StatisticsHandler.java:173)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
at org.eclipse.jetty.server.Server.handle(Server.java:500)
at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:383)
at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:547)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:375)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:270)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129)
at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:388)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:806)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:938)
at java.lang.Thread.run(Unknown Source)
BTW, Splunk service using admin identity with DB access Privilege
Systems versions:
Windows Server 2016
Splunk version: 8.0.3
MS SQL 2017 Database version 14.0.3281.6
JRE Version 8 (1.8.0_241)
JDBC Driver Version 8.2.2
DB Connect App 3.3.0
... View more
10-24-2019
08:57 AM
Hi @gaurav_maniar
Actually it's my bad after I had a big cup of coffee 😄 and reviewing my search query again I found the token was defined in a sub-search , so in the results it will come to the second row or the third in the table - depending on the order of the sub-search. so in that case token was getting null.
I have modified the token definition to be in the main search and it's working fine now,
Thanks for your reply my friend.
Happy Splunking to you too 😉
... View more
10-24-2019
05:07 AM
Hello,
I am using custom image map viz and I want to pass the token "image" to define different image name depending on the search result
<panel>
<title>Site Structure</title>
<viz type="custom-image-map-viz.map_viz">
<search>
<query> |MY SEARCH
<done>
<set token="image">$result.site_image_type$</set>
</done>
</search>
<option name="custom-image-map-viz.map_viz.allPopups">0</option>
<option name="custom-image-map-viz.map_viz.backgroundColor">#006d9c</option>
<option name="custom-image-map-viz.map_viz.defaultHeight">600</option>
<option name="custom-image-map-viz.map_viz.drilldown">0</option>
<option name="custom-image-map-viz.map_viz.focusClicked">0</option>
<option name="custom-image-map-viz.map_viz.fullScreen">0</option>
<option name="custom-image-map-viz.map_viz.mapCenterX">300</option>
<option name="custom-image-map-viz.map_viz.mapCenterY">380</option>
<option name="custom-image-map-viz.map_viz.mapCenterZoom">0</option>
<option name="custom-image-map-viz.map_viz.mapHeight">701</option>
<option name="custom-image-map-viz.map_viz.mapImage">$image$</option>
<option name="custom-image-map-viz.map_viz.mapWidth">658</option>
<option name="custom-image-map-viz.map_viz.maxZoom">0</option>
<option name="custom-image-map-viz.map_viz.minZoom">0</option>
<option name="custom-image-map-viz.map_viz.multiplePopups">0</option>
<option name="custom-image-map-viz.map_viz.scrollWheelZoom">0</option>
<option name="custom-image-map-viz.map_viz.showPath">1</option>
<option name="custom-image-map-viz.map_viz.showPointerCoordinates">0</option>
<option name="custom-image-map-viz.map_viz.unfocusedOpacity">0.1</option>
<option name="drilldown">none</option>
<option name="height">804</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
Is this possible ?? to change any Viz option based on a token?
Thanks
... View more
- Tags:
- splunk-enterprise
04-24-2019
06:16 AM
it didn't for me 😄
... View more
04-11-2019
05:29 PM
Hello @adlireza
Hope you can update us with your working solution at the end.
Thanks
... View more
03-05-2018
12:41 AM
could this work on lookup output fields also ?? and what will be the solution if not?
... View more
02-10-2018
01:28 AM
I don't have the formula 😞
... View more
02-10-2018
01:16 AM
it's giving a wrong result
if you used this website https://www.ipaddressguide.com/ip to convert between decimal IP and dotted quad IP the result of converting 170468155 is 10.41.35.59 while your eval result is 170.468155.155
The issue is not adding the "." , it needs calculations!
... View more
02-10-2018
12:41 AM
I saw that answer before asking my question.. it's a different case
... View more
02-10-2018
12:39 AM
That didn't work!
... View more
02-09-2018
10:42 PM
Hello Guys,
I'm working on Data which is exported by telecom devices and IPs is exported in Decimal format as 170468155
can you help to convert this to normal dotted quad IP format xxx.xxx.xxx.xxx ?
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-10-2025
10:28 AM
|
Karma given to
