Hi All, Httpevent collector logs in to splunk, not showing the host,source,sourcetype in splunk, please find the below screen shot, please help me.     ... View more

The above screen shot Blue color line event into one Event and above Blue color lines in to single event  please provide line break event queries.   ... View more

Hi team,   Currently we are implemented the Standalone below servers, Zone-1 Environment Server Name IP Splunk Role DEV L4     Search Head+ Indexer QA L4     Search Head + Indexer L4     Deployment Server   Zone-2         Environment Server Name IP Splunk Role DEV L4     Search Head + Indexer QA L4     Search Head + Indexer   In our environment, only 2 Indexer + Search head server is there on the same instance   How to Implement the High Availability Servers?   please help me the process.              ... View more

Hi team, Upload the CSV file into Splunk, In CSV file form 47th row to 7th row into single event, written configuration  but single event is not working. please find the below screen shot   From   To  7th Row csv file   the above screen shot after loaded the splunk , it's not single event for 47th row 7 row. please help configuration above. ... View more

Hi team    Created the Customize field in Splunk Alert mechanism, but in the incident receiving the single record only , Multiple records are not fetching the incident, please find the below     location=KC xxxxxxxx Corporate Center||comments=Look into VPR Quality Docs Notifications Outlook email for Actual errors||description=Login to VPR Server and Quality Docs Vault to troubleshoot issue; $result._time$ $result.host$ $result.Message$ $result.source$ $result.log_level$ $result.error_message$   Please help me  ... View more

Hi team, I had upgraded from 9.0.5 version to 9.1.2 and upgradation successfully completed, but splunk web page can't reach this page  window displayed. and verified the bin  directory E:\splunk\bin>openssl s_client -connect simdoowwww:443 WARNING: can't open config file: ::::::/openssl.cnf connect: No such file or directory connect:errno=0     web.conf   [settings] enableSplunkWebSSL = 1 privKeyPath =a $SPLUNK_HOME\etc\auth\custom\myServerPrivateKey.key serverCert = $SPLUNK_HOME\etc\auth\custom\gddjkowww.ap.kinely.com.pem httpport = 443     The above configuration  in back end system, but page can't read this page displayed please help me on that.     ... View more

Hi Team,    Currently we are installed the Splunk DB app in Heavy Forwarder, How to Connect this app from Heavy Forwarder to Splunk Cloud Search Head+Indexer server ? ... View more

Hi team , 1 .How to monitor the Splunk DB logs, already installed and configured. 2. How to 2 queries of splunk db ingest into single index?   ... View more

Hi Team, My requirement is Universal Forwarder installation on Kubernetes On-premises system.   Please send me guide on installation on Kubernetes.        ... View more

Hi,  UF etc/apps/remo/local  placed the inputs,outputs,props and tranforms configuration files  and search the data in indexer+SearchHead  servers , Events  are received Successfully. [monitor://E:\KS Application GBR (GR)\sbxLogs\] index = ks_dev sourcetype = ks_logs crcSalt = <SOURCE>   [tcpout:bprserver] server = 1.2.3.4:9997 useACK = true [ks_logs] TRANSFORMS--null = EXCLUDE_INFO_WARN_events [EXCLUDE_INFO_WARN_events] REGEX = ^[\d|-]*\s[\d|:|,]*\s(INFO|WARN).*$ DEST_KEY = queue FORMAT = nullQueue   Same configuration updated in the deployment server etc\deploymentapps\ksapp\local [monitor://E:\KS Application GBR (GR)\sbxLogs\] index = ks_dev sourcetype = ks_logs crcSalt = <SOURCE> [tcpout:bprserver] server = 1.2 3.4:9997 useACK = true [ks_logs] TRANSFORMS--null = EXCLUDE_INFO_WARN_events [EXCLUDE_INFO_WARN_events] REGEX = ^[\d|-]*\s[\d|:|,]*\s(INFO|WARN).*$ DEST_KEY = queue FORMAT = nullQueue   Events are receiving  the SH+indexer server Note: in my account there is no HeavyForwarder instance. please help how to do configuration in deployment server.                 ... View more

Hi Team i had provided user roles  has Read only access. but user having edit and delete the reports, how to restrict  the user access as Read only access for the reports, The below had provided  configuration and Roles capablities  had given below.   Please help me  how to restrict the user  access.  User not able to delete option  and not able edit Splunk Queries.     [savedsearches/krack_delete] access = read : [ * ], write : [ power ] export = system owner = vijreddy@xxxxxxxxxxxxx.com version = 9.0.5.1 modtime = 1704823240.999623300     ... View more

Hi Team,   In role we are providing the user as read only access, and set up the capabilities, Inheritress , resources, and restrictions.  But that user able to delete the query and delete the report also, how do we hide delete option in the report?   Please guide the process.         ... View more

Hi Team, In my requirement, if any splunk servers are got failed, need to be generated Services now incidents need to be created automatically...   How do we write the query and how do we configure Service now incidents, please help me      ... View more

Hi Team,   In my project need to be implement High Availability servers in below Servers are using. Z1-->L4 -->SearchHead+Indexer single instanceonly(Dev)               SearchHead+Indexer single instanceonly(QA) DeploymentServer(QA) HearvyForwarder(Prod) DeploymentServe(Prod) -------------------------------------------------- App related below server:   Z2 --> HearvyForwarder(Prod,Dev,QA) individual Servers Z3--> HearvyForwarder(Prod,Dev,QA) individual Servers   The above App related servers are connected Deployment server and SearchHead+Indexer Note : my project there is no Cluster master   Please help how do we implement the High Availability implementation, please help the guide the above servers.     ... View more

Hi All, The below 10 Error Records have, Last 3 Error records need not ingested, the above 7 error records data only be ingested.How do we write the Regular Expression ,please guide me.     2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - PCI ERROR: No package class found with name: PRD-QDB35801A 2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - PCI ERROR: (INVALID_DATA) Invalid value [V5100000003P211] specified for parameter [package_class__c] : Object record ID does not resolve to a valid active [package_class__c] 2023-11-06 15:30:48,941 ERROR https-jsse-nio-8443-exec-9 com.veeva.brp.batchrecordprint.BatchRecordPrintController - PRINT ERROR: Print failure response 2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - Unknown error: {errorType=GENERAL, responseStatus=EXCEPTION, responseMessage=502 Bad Gateway} 2023-11-06 15:30:48,941 ERROR https-jsse-nio-8443-exec-2 com.veeva.brp.batchrecordprint.BatchRecordPrintController - (API_LIMIT_EXCEEDED) You have exceeded the maximum number of authentication API calls allowed in a [1] minute period. 2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - PCI ERROR: No package class found with name: PR01-PU3227V1MSPS 0001 2023-11-08 06:19:49,539 ERROR https-jsse-nio-8443-exec-1 com.veeva.brp.batchrecordprint.BatchRecordPrintController - DOCLIFECYCLE ERROR: Error initiating lifecycle action for document: 5742459, Version: 0.1 2023-10-25 10:56:46,710 ERROR pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks - Header Field Name: bom_uom_1_c, value:E3HR5teHlfOQjzUJ74jTdKh1Tu0yajHqT/H98klZOyU= 2023-10-25 10:56:46,711 ERROR pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks - BOM Field Name: BOM_Added_1, value is out of Bounds using beginIndex:770, endIndex:771 from line: 2023-10-25 10:56:46,711 ERROR pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks ... View more

  Hi All,   2023-10-25 10:56:46,709 WARN pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks - BOM Field Name: BOM_PPMDS_1, value is out of   The above WARN message replace to ERROR message, please find the below ERROR message.   2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - Unknown error: {errorType=GENERAL,   How to write props .conf and transforms.conf configuration files. please help me.   Regards Vijay .K         ... View more

Hi All,   My requirement is source data records data need to be encrypted. What does process need to follow? Is there any possibly  props.conf ?   Please help me the process.   Regards, Vij  ... View more