Hi, I am using Splunk 8.2.1 and I have configured the docker daemon to send logs to Splunk via an HTTP collector. I have set up the source "swarm:docker" with the following props.conf file       [swarm:docker] DATETIME_CONFIG = INDEXED_EXTRACTIONS = json KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true category = Structured description = Log Swarm disabled = false pulldown_type = true       The logs arrive in splunk with the right source type, but I don't have the fields extraction...I don't understand what's wrong   Can you help Me ? ... View more

Hello, we monitor files generated by processes launched by several users on the same server. There is not in the name of the files the reference of the user. On the other hand, the user is informed as the owner in the NTFS rights of the file. Is there a solution to retrieve this information to use it as a field value or to rename the splunk source by adding this information. This would allow us to build dashboards by users. Thanks for your help ... View more

Hi I'm trying to deploy the splunk connector on my kubernetes cluster. Here is my config file global: splunk: hec: token: 16e1174f-0989-4410-b801-225ff63ef7b8 host: srvinf.coolcorp.priv port: 8088 indexName: idx_k8s_logs insecureSSL: true kubernetes: # connection to kubernetes is insecure insecureSSL: true splunk-kubernetes-metrics: splunk: hec: indexName: idx_k8s_metric I deploy the solution with the command "helm install splunk-collector -f splunk-conf.yaml https://github.com/splunk/splunk-connect-for-kubernetes/releases/download/1.4.0/splunk-connect-for-kubernetes-1.4.0.tgz" Unfortunately, some pod crashes on a loop. root@k8s-worker-001:/home/bvivi57# docker logs ce9940e8f4d2 2020-04-21 07:47:21 +0000 [info]: parsing config file is succeeded path="/fluentd/etc/fluent.conf" 2020-04-21 07:47:21 +0000 [info]: gem 'fluent-plugin-jq' version '0.5.1' 2020-04-21 07:47:21 +0000 [info]: gem 'fluent-plugin-kubernetes_metadata_filter' version '2.4.2' 2020-04-21 07:47:21 +0000 [info]: gem 'fluent-plugin-prometheus' version '1.7.0' 2020-04-21 07:47:21 +0000 [info]: gem 'fluent-plugin-record-modifier' version '2.1.0' 2020-04-21 07:47:21 +0000 [info]: gem 'fluent-plugin-splunk-hec' version '1.2.1' 2020-04-21 07:47:21 +0000 [info]: gem 'fluentd' version '1.9.1' 2020-04-21 07:47:22 +0000 [error]: config error in: @type splunk_hec data_type metric metric_name_key "metric_name" metric_value_key "value" protocol hec_host "http://srvinf.coolcorp.priv" hec_port 8088 hec_token "5285bf89-5c6c-4ca4-82de-71ce95d227fc" host "k8s-worker-001" index "idx_k8s_metric" source "${tag}" insecure_ssl true @type memory chunk_limit_records 10000 chunk_limit_size 100m flush_interval 5s flush_thread_count 1 overflow_action block retry_max_times 3 total_limit_size 400m 2020-04-21 07:47:22 +0000 [error]: config error file="/fluentd/etc/fluent.conf" error_class=Fluent::ConfigError error="valid options are http,https but got " I can't understand my mistake. Can you help me? ... View more

Hi, I am trying to query a Rest API from within the application. The query seems to work and be executed but no data is indexed. If I test a simple curl from the Splunk server, I have a return. If I listen to the exchanges between the Splunk server and the url, there is a return. Here is my setup I do not see any error in log splunkd.log I do not know what to look at. Can you help me understand why no data arrives in the index? ... View more

Hi, I have to search saved as quickly as possible. I CSV indexes whose columns are sometimes empty. I have to put a value by default with the fillnull command because the data is used by external software (Tableau ) The docs say (https://docs.splunk.com/Documentation/ODBC/2.1.0/UseODBC/Troubleshooting 😞 "Null fields are not handled in the same way as you might be used to with other database systems. For example, they might inconsistently appear when you add or remove columns to your query. This behavior is expected. To prevent this from happening, add functionality to your report (saved search in Splunk Enterprise 5) that gives null fields a constant literal value—for example, the string "Null". This ensures that null fields appear consistently." But the command fillnull slowed search. So I would like the empty fields or tagged it with a value by default to avoid calling the fillnull order. It is possible? ... View more