This resolved my issue.  ... View more

@vikramyadav wrote: Can you check internal log of splunk and provide some more details about error. And also can you mention form which python script you are getting error. Had similar issue. For whatever reason ours would only throw on the SHC members. I would go into the README directory in the app and comment out the entirety of the inputs.conf.spec. Once that was performed all alerting on stopped.   0000 INFO SpecFiles - Found external scheme definition for stanza="splunk_ta_aws_sqs://" from spec file="/opt/splunk/etc/apps/Splunk_TA_aws/README/inputs.conf.spec" with parameters="placeholder" 0000 ERROR ModularInputs - No script to handle scheme "splunk_ta_aws_sqs" was found. This modular input will be disabled. 0000 ERROR ModularInputs - Unable to initialize modular input "splunk_ta_aws_sqs" defined inside the app "Splunk_TA_aws": Unable to locate suitable script for introspection. These would also fire on standalone search heads but only at startup. With the SHC members it was continuous every few minutes. Commenting out the inputs.conf.spec stopped the issue. Since the TA for the search head wasn't there to ingest data we had no concerns commenting it out. ... View more

@cboillotDid you solved the issue in your DMC? ... View more

Thanks for the tip! I went to give this a go, but it looks like someone has had a tidy up and we now only have ~80k users in AAD (University - high user turnover). The default settings work fine for 80k, but I'll keep this in mind in case we tip over the limit again. ... View more

Just ran into this as well. Having to use the ref instead of |savedsearch means I'll be pulling in quite a bit more data and then using the input of dashboard panel to filter. ref -> can't pass variables/tokens but can run as owner of saved search |savedsearch -> can't run as owner of saved search when passing variables/tokens ... View more

The docs linked say that artifact_offset defaults to 0, which says to me that this shouldn't change any behaviour. Is this a change in behaviour between this post and now, or is the documentation would and the default state differs to an explicit artifact_offset=0 ? ... View more

I know this is is an old answer but have you tried this out? I am getting "invalid hostname" when trying to use register_replication_address..and yes the peer and CM can reach each other and even resolve. Also im using IP for testing. ... View more

If it's scheduled it must run as owner. Could modify the metadata files to shift ownership or remove it entirely (nobody). The run as owner or user referenced above I believe is for dashboards and the running of searches. You can build the dashboard to run the search contained within it, which runs as the user accessing the dashboard. Or you can set up the dashboard to reference the saved search which can run as the owner for that search. ... View more