It is possible that when you ran the pip install command the azure-keyvault module got installed in the directories pertaining to the Linux system version of Python and not the Splunk version of Python. When I have needed modules that aren't in the Splunk Python I add the module to the bin folder of my app so that it's part of the app. Installing/placing the module in Splunk's Python means that when you upgrade Splunk the module could get removed. ... View more

Hi @bhuvanabala, This should do the trick : index="XXX" sourcetype="RRR" |eval expirationdatetime=strptime(expirationdatetime,"%Y-%m-%dT%H:%M:%S.%Q") |where expirationdatetime < relative_time(now(), "-+2d") Let me know if it helps. Cheers, David ... View more

Hi @bhuvanabala , Could you please let me know what did you do fix the issue as I got stuck into the same situation and events are showing as 0 for the index though it's is displaying the event in output console? ... View more

I haven't used the Okta app before, but the docs have this part about setting up a proxy. Therefore, it's very likely the app accesses an API on the internet, and you need to make sure that such access is possible, either by changing firewall rules, or using your proxy server. I'd have a chat with my network security people. 😉 Hope that helps! ... View more

Thanks it worked for me ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

One thing that you need to consider is that the DB Connect app uses the splunk.secret to encrypt/decrypt the identity credentials. So you will want to ensure that the splunk.secret is the same between the 2 machines. There are 2 locations that you have to migrate if you plan on migrating the app to a new server (assuming that the splunk.secret is the same on both servers). These locations are: $SPLUNK_HOME/etc/apps/splunk_app_db_connect/ $SPLUNK_HOME/var/lib/splunk/modinputs/server/splunk_app_db_connect The first directory is the App directory. The second directory is the checkpoint value for any rising columns that you have configured. ... View more

I have several installs where Splunk is installed on D, however more recently I prefer to install to c:\Program Files\ but locate my indexes on a separate volume. This keeps all the paths as default, but lets me separate out the bulk of the data elsewhere, It also means I can detach/move/reattach my data volume between systems, as I only use windows for testing. (Prod is always Linux for me) However - for your specific issue, can you share a copy of the installer log. You may want to configure installer logging first: https://support.microsoft.com/en-gb/help/223300/how-to-enable-windows-installer-logging ... View more