@phanTom In a large organization as you may know, the focus and expectations of users can be vary widely. It sounds like your energy may be low for a feature request to allow customization of the Phantom dashboard time filters. With one of my many roles being a Phantom admin, I do not desire to understand and maintain an additional setting that someone suggests is value added to Phantom unless several folks agree with it. What are your thoughts on a feature request for text next to the time filter dropdown that communicates the create time of the oldest container record or something similar to give the user more info about the data in the Phantom dashboard (see1st screenshot below)? Do you think that the Phantom community would be more supportive of it? As a comparison, the Splunk Enterprise search dashboard has a graph to indicate that amount of data available (see second screenshot below). Custom Splunk Enterprise dashboards much more capabilities to fulfill user requests like this one than the Phantom product. For a more direct comparison, a Splunk Enterprise user can select their own home dashboard (custom or not) in the Search app (see third screenshot below).     ... View more

Thanks @darrenk_splunk . Based on the info that you provided, I agree...it is not a bug. The Linux "cat" and grep commands help explain the unexpected output also. [root@localhost bin]$ cat /opt/splunk/etc/system/default/inputs.conf | grep "monitor://" [monitor://$SPLUNK_HOME/var/log/splunk] [monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*] [monitor://$SPLUNK_HOME/var/log/splunk/license_usage_summary.log] [monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*] [monitor://$SPLUNK_HOME/etc/splunk.version] [root@localhost bin]$ ... View more

@rob_jordan With your confirmation and confirmation from other users, I am just reporting a possible bug (update 1/21/2020: not a bug...see answer below), and spreading awareness that the btool may not return the expected output for certain input. My question here was worded in the off-chance that it is not a bug, and the output could be explained. Per a recent Data Admin training class, the entire stanza name can be included in the btool command. For another example, the "monitor:///var/log" stanza (i.e. entire stanza name) returns the expected output (see below). However, certain stanzas in the default inputs.conf file do not return the expected output. I am aware that it appears that using grep is a work around. However, I would think that you would agree that It is inconsistent behavior of the btool command, and Splunk users should be aware of it. [root@localhost bin]$ ./splunk btool inputs list monitor:///var/log [monitor:///var/log] _rcvbuf = 1572864 blacklist = (lastlog|anaconda.syslog) disabled = false host = localhost.localdomain index = default whitelist = (.log|log$|messages|secure|auth|mesg$|cron$|acpid$|.out) [root@localhost bin]$ ... View more

@BainM Mike, I am glad that you were able to resolve the issue(s) with your custom index. No credentials for the network node(s) in your Node List are required for the "Check ssh Port Open" Command Type. The "Check ssh Port Open" Command Type uses the Python socket library to check if the ssh port is open which does not require logging into the ssh server of the network node(s). Regards, Jeff ... View more

@rob_jordan To re-create the issue, you have to include the name of the stanza with the btool command. [splunk@localhost bin]$ ./splunk btool inputs list monitor:///opt/splunk/var/log/splunk [splunk@localhost bin]$ Based on the output in your post, the stanza name would be monitor:///opt/spl/splunk/var/log/splunk for your Splunk instance. ... View more

@BainM I just created an index named cliautoIdx using the Splunk Web GUI. Splunk changed the uppercase "I" to a lowercase "i"; so the uppercase "I" could be causing the error(s). ... View more

@BainM Splunk Answers website removed the backslash character in the second btool comand. I was able to edit my question, and add another backslash to get one backslash to appear. Adding the backslash should fix the regex error. I am using a CentOS VM. I agree...it is an odd response from btool. Other stanzas with a /opt/splunk/var/log parent path are not returned by "splunk btool inputs list" command also using the entire stanza name. ... View more

@psychogyiokostas Based on your responses and other answers here, I would guess that both methods for ingesting the data (CLI and UI) is indexing all of the data, but during the indexing process, the data is ingested with the event break configuration for the sourcetype being different due to the process performing the ingestion using a different context. The props.conf file(s) controls the event breaks, but there are (can be) several props.conf files in a Splunk environment. See https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Wheretofindtheconfigurationfiles which explains the configuration (conf) file precedence. Also, the existence of multiple contexts (i.e global and app contexts) which follow different configuration (conf) file precedence does not make it easier. At the CLI, you can execute the following splunk command to view the props.conf settings being used for the context at command prompt, but you will need to know which stanza applies for ingesting your data. Unfortunately, the btool command is not supported in the UI, but Splunkbase contains some "btool" apps that may be helpful. A Splunk feature request could be to ask for better tools to view configuration (conf) file precedence based on an user chosen context. ./splunk btool props list --debug P.S. The Splunk Answers tag "CLI Auto for Splunk" is for an app that I developed and shared on Splunkbase. While I appreciate the visibility for the app, your question does not seem related to this app. The "CLI Auto for Splunk" app is an automation tool for executing CLI commands on any network device with a CLI (ssh) interface. You might try searching for other Splunk Answers tags that might be more related to your question. ... View more

We ended up using the "Splunk DB Connect" app which query's the Solarwinds tables for the needed data. It requires a bit of knowledge about the Solarwinds DB schema and "checkpointing" a Splunk data source for Solarwinds logging tables. Also, we replicated the Solarwinds NPM CustomPollerStatistics_Detail table (and added an identity column to this replicated table) using MS SQL server replication since the DateTime field was not a good checkpoint field for the "Splunk DB Connect" app. Also, see these Solarwinds Thwack and Splunk answer posts https://thwack.solarwinds.com/thread/120056 and https://answers.splunk.com/answers/596395/what-are-the-steps-to-configure-an-incremental-pol.html . ... View more