Does anyone know if there a plan to support chronyd in addition to the legacy ntpd? Chronyd is the default in RHEL7/Centos7. Or if anyone has updated time.sh to support chronyd? Regards, Mikael Lindstrom ... View more

Hi, what's the ETA for supporting Chrony in addition to NTP? As per the release notes, RHEL 7 and CENTOS 7 are supported, but the default network time protocol function is Chrony. Btw. Went to the Splunkbase page for this add-on (which in general is very useful!) and the "File a case" link doesn't work. Regards, Mikael Lindstrom ... View more

Hi, Has anyone been able to parse XML files in 3GPP 32.435 format? It's an XML formatted file with performance measurements. In the sample below, the node that generates this file has connections to extNode1-4 and generates statistics for 2 types of counters (countername1 (p=1), countername2 (p=2)) for each of the external nodes. - so in this file, a total of 8 measurement points, 2 for each external nodes. I'm a little unsure of how to best parse this in Splunk. <fileHeader fileFormatVersion="32.435 V10.0" vendorName="XXXX"> <fileSender localDn="ManagedElement=Node" elementType="YYYY"/> <measCollec beginTime="2019-06-17T17:45:00-07:00"/> </fileHeader> <measData> <managedElement localDn="ManagedElement=Node" swVersion="XXXYYYZZZZ"/> <measInfo measInfoId="DscRemotePeer"> <job jobId="Blade_test"/> <granPeriod duration="PT900S" endTime="2019-06-17T18:00:00-07:00"/> <repPeriod duration="PT900S"/> <measType p="1">countername1</measType> <measType p="2">countername2</measType> <measValue measObjLdn="DscFunction=1,DscNodes=1,DscNode=Node,DscAdjacentRealms=1,DscAdjacentRealm=extNode1.domain.com,DscRemotePeers=1,DscRemotePeer=extNode1"> <r p="1">0</r> <r p="2">0</r> </measValue> <measValue measObjLdn="DscFunction=1,DscNodes=1,DscNode=Node,DscAdjacentRealms=1,DscAdjacentRealm=extNode2.domain.com,DscRemotePeers=1,DscRemotePeer=extNode2"> <r p="1">0</r> <r p="2">0</r> </measValue> <measValue measObjLdn="DscFunction=1,DscNodes=1,DscNode=Node,DscAdjacentRealms=1,DscAdjacentRealm=extNode3.domain.com,DscRemotePeers=1,DscRemotePeer=extNode3"> <r p="1">0</r> <r p="2">0</r> </measValue> <measValue measObjLdn="DscFunction=1,DscNodes=1,DscNode=Node,DscAdjacentRealms=1,DscAdjacentRealm=extNode4.domain.com,DscRemotePeers=1,DscRemotePeer=extNode4"> <r p="1">0</r> <r p="2">0</r> </measValue> </measInfo> </measData> <fileFooter> <measCollec endTime="2019-06-17T18:00:00-07:00"/> </fileFooter> Regards, Mikael Lindstrom ... View more

Hi, I'm having a problem with setting up my data stream for scripted input. I have the splunk universal forwarder setup on my node and it's working. I have a script that prints a JSON object (I also have script that generates key-value pair events and have the same problem with that) and I've setup the following configuration: etc/system/local/inputs.conf [script://$SPLUNK_HOME/bin/scripts/rdb_vm_status.sh] interval=60 index=vecc disabled=0 source=rdb_vm_status sourcetype=rdb_vm_status [host]$ cat props.conf [rdb_vm_status] KV_MODE = json TIMESTAMP_FIELDS = tl_timestamp SHOULD_LINEMERGE = false Output from script: [host]$ ./splunk cmd scripts/rdb_vm_status.sh { "tl_timestamp" : "2019-05-08 07:29:32", "VIP" : "10.145.14.180", "agent": [ { "IP": "10.145.14.179", "type": "Standby", "state": "UP", "db_state": "UP"},{ "IP": "10.145.14.178", "type": "Master", "state": "UP", "db_state": "UP"}, { "IP": "10.145.14.177", "type": "Standby", "state": "UP", "db_state": "UP"} ], "db_insync": "yes"} [host]$ I can see the events in Splunk search (not the same event but an older one): { [-] VIP: 10.145.14.180 agent: [ [+] ] db_insync: No Master DB found tl_timestamp: 2019-05-07 15:44:54 } Show as raw text Event Actions Type Field Value Actions Selected host bl2ecmrdb1.vcc.t-mobile.lab source rdb_vm_status Time _time 2019-05-07T15:44:54.000-07:00 Default index vecc linecount 1 sourcetype rdb_vm_status splunk_server blvnnm03 I would expect to be able to see the event fields if I click on "All Fields" in left sidebar and have them available there. So apart from inputs.conf and props.conf, is there any other configuration I need to do to setup this data ingestion? Regards, Mikael ... View more