Hey Folks,  For some reason, I am not able to have the dashboard description added when I use export PDF option, I have already mentioned the necessary settings in the alert_actions.conf file  Splunk version - 7.2.5  <form script="table-js.js, tooltipv3.js"> <label>Some Dashboard</label> <description>My Description</description> [email] pdf.logo_path = /opt/splunk/etc/apps/myapp/appserver/static/logo_new1.png pdf.header_left = logo pdf.header_center = title pdf.footer_left = description reportPaperOrientation = landscape Is there something I am missing! Please suggest @niketnilay  ... View more

I am facing issues while configuring Smart PDF exporter app, though  I have provided settings correctly for during the setup option, it keeps on throwing the error as "Please finish setting up the smart export application (restart may be required)"  I have provided the user credentials with the capability  can_schedulepdf and email server and PhantomJS installation path.    ... View more

Hi All, I am using the Splunk Add-On for AWS to fetch the CloudWatch log group events, add-on is installed on HF and all the logs are getting TZ property from System TZ property of HF(EDT). Now I wanted to change the TZ for couple of CloudWatch log groups to UTC. Hence, I tried configuring the props.conf in the Splunk_TA_AWS/local with following settings [cloudwatch:lamba:groups] TZ = UTC But I don't see logs are getting this property getting applied for this sourcetype logs Is there some other way, we need to config TZ property for AWS logs. ... View more

Hi All, Recently I have noticed that some of the our Saved Searches are failing with the errors like below, "Failed to start search for id="scheduler__abcde__Qk1TX1dNX0lOVEdfTUVUUklDUw__RMD57438a1f3bbe5dac6_at_1588593600_88844". Dropping failedtostart token at path=/opt/splunk/var/run/splunk/dispatch/scheduler__abcde_Qk1TX1dNX0lOVEdfTUVUUklDUw__RMD57438a1f3bbe5dac6_at_1588593600_88844 to expedite dispatch cleanup Could anyone suggest what could be the issue ? ... View more

Hi All, I have recently LDAP connection on one of our HF, it's giving us the error " ERROR ScopedLDAPConnection - strategy="my_LDAP" Error binding to LDAP. reason="Inappropriate authentication" , I have used same configuration across other Splunk components, I am not seeing the error there, also I am able to login successfully using the LDAP on those instances. Could anyone suggest a solution please ? @woodcock @richgalloway ... View more

Hi All, We had setup an alert that runs everyday, it's been working fine until today. Today, we see that alert is triggered with no results, but when we run search same search for same timerange, it is showing the results. Here is the entry in the scheduler.log 03-26-2020 03:20:36.406 -0400 INFO SavedSplunker - savedsearch_id="nobody;myapp;alertname", search_type="scheduled", user="test", app="myapp", savedsearch_name="alertname", priority=default, status=success, digest_mode=1, scheduled_time=1585207200, window_time=0, dispatch_time=1585207235, run_time=0.170, result_count=1, alert_actions="email", sid="scheduler__test_Qk1TX1dNX0lOVEdfTUVUUklDUw__RMD522d64366074c1a92_at_1585207200_23138", suppressed=0, thread_id="AlertNotifierWorker-0" When I tried checking the results of the triggered alert, it is showing that the alert was no longer exist, and when I tried with |loadjob scheduler__test_Qk1TX1dNX0lOVEdfTUVUUklDUw__RMD522d64366074c1a92_at_1585207200_23138 it says that sid doesn't exist. I have checked in the dispatch directory and I don't a directory with the name of the that sid. Could anyone help me to see to find out what were the results of the alert and if any issues with the alert ... View more