I have a role in SH where the user is not able to send an email to a specific user or groups. What capabilities does a role require that can send an alert that can trigger an email to users and to DL.(7.1.5) ... View more

i have a csv file with header column"Name","CapacityGB","FreeSpaceGB" with the line number 1. This header is also coming along with the next line as one single event: I have used the below props.conf: [xxxxx] INDEXED_EXTRACTIONS = CSV DATETIME_CONFIG = CURRENT NO_BINARY_CHECK = true SHOULD_LINEMERGE = true MUST_BREAK_AFTER = (\,\"\d+.\d+\"$) FIELD_DELIMITER=, FIELD_QUOTE=" ISSUE: 1/27/19 4:31:01.000 AM "Name","CapacityGB","FreeSpaceGB" "xxxxxx","1008.374375","486.1959375" Please let me know how to exclude the header file. Do i have to update anything on props.conf? ... View more

We are using Windows infrastructure app to collect the windows event log. In our criteria, we have the event logs getting into Splunk but some of the event code is missing. Could you please let me know what are possible ways to troubleshoot this issue? ... View more

Why are Splunk forwarders failing to send some of the Windows application Event logs for some devices? We are using Splunk_TA_windows add on for ingesting the window event viewer logs into splunk. We do not observer any Error in the internal log but found some Warning Message as mentioned below: 3/19/18 11:33:47.270 PM 03-19-2018 23:33:47.270 -0400 WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Mon Mar 19 23:33:47 2018). Context: source::WMI:Services|host::XXXXXX|WMI:Services|1 host = XXXXXX source = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log sourcetype = splunkd 3/19/18 10:50:29.897 PM 03-19-2018 22:50:29.897 -0400 WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Mon Mar 19 22:50:29 2018). Context: source::WMI:SessionProcess|host::XXXXXX|WMI:SessionProcess|1 host = XXXXXX source = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log sourcetype = splunkd 3/19/18 10:48:36.030 PM 03-19-2018 22:48:36.030 -0400 WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Mon Mar 19 22:48:35 2018). Context: source::WMI:SessionProcess|host::XXXXXX|WMI:SessionProcess|1 host = XXXXXX source = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log sourcetype = splunkd 3/19/18 10:45:09.527 PM 03-19-2018 22:45:09.527 -0400 WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Mon Mar 19 22:45:09 2018). Context: source::WMI:SessionProcess|host::XXXXXX|WMI:SessionProcess|1 host = XXXXXX source = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log sourcetype = splunkd Please find the inputs.conf: [WinEventLog://Application] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 index = wineventlog renderXml=false _meta=fromserver::Y Is there any other configuration that i needed to check? What am i missing here to check? ... View more

Need an understanding on this below configuration: [default] evt_dc_name = evt_dns_name = we have the above configuration in splunk_TA_windows.Could you please let me know what does it mean when we have empty value assigned for it ... View more