I am aware there is an accepted answer that helped me, but the connection was not established with the message 'need further details.' However, I need to do some extra configuration to establish the connection. I followed accepted answer for jdbc driver(downloaded snowflake-jdbc-3.15.1.jar ) and to configure db_connection_types.conf ( don't copy and paste it from accpeted answer. see below db_connection_types.conf Followed below link to fix the issue: could not initialize class net.snowflake.client.jdbc.internal.apache.arrow.memory.util.MemoryUtil https://community.snowflake.com/s/article/JDBC-OutOfDirectMemoryError I added the first two options from the above solution (you can see below in case the above link is broken or removed) to the JVM Options in connection settings with a space delimiter. It didn't work. However, the connection got established with the third solution. (See db_connections.conf also to understand how that parameter is used.)   1.) Increase the maximum heap size, which in return will increase the maximum direct memory size. You will need to refer to the application's documentation for instructions on how to configure this value because it is application-specific. If you were starting the application using the java command then any of the following JVM arguments will set the maximum heap size to 1 GB: -Xmx1048576k -Xmx1024m -Xmx1g 2.) Explicitly increase the maximum direct memory size. E.g., the following JVM sets the value to 1 GB: -XX:MaxDirectMemorySize=1g 3.) If for any reason you do not have any control over the amount of memory you can allocate to your JVM (e.g., you are limited by the size of the container you're running in and it cannot be configured) then change the query result set from ARROW to JSON. You can pass this setting as a connection parameter using your JDBC driver: JDBC_QUERY_RESULT_FORMAT=JSON   Final db_connections.conf and db_connection_types.conf   local/db_connection_types.conf [snowflake] displayName = Snowflake serviceClass = com.splunk.dbx2.DefaultDBX2JDBC jdbcDriverClass = net.snowflake.client.jdbc.SnowflakeDriver jdbcUrlFormat = jdbc‌‌//:/?db= ui_default_catalog = $database$ port = 443 local/db_connections.conf [Snowflake_DB] connection_properties = {"JDBC_QUERY_RESULT_FORMAT":"JSON"} connection_type = snowflake customizedJdbcUrl = jdbc‌‌//.snowflakecomputing.com:443/?user=&db=snowflake&warehouse=&schema=public database = snowflake disabled = 0 host = .snowflakecomputing.com identity = SnowflakeUser jdbcUseSSL = false localTimezoneConversionEnabled = false port = 443 readonly = false timezone = Etc/UTC       ... View more

I am aware there is an accepted answer that helped me, but the connection was not established with the message 'need further details.' However, I need to do some extra configuration to establish the connection. I followed accepted answer for jdbc driver(downloaded snowflake-jdbc-3.15.1.jar ) and to configure db_connection_types.conf ( don't copy and paste it from accpeted answer. see below db_connection_types.conf Followed below link to fix the issue: could not initialize class net.snowflake.client.jdbc.internal.apache.arrow.memory.util.MemoryUtil https://community.snowflake.com/s/article/JDBC-OutOfDirectMemoryError I added the first two options from the above solution (you can see below in case the above link is broken or removed) to the JVM Options in connection settings with a space delimiter. It didn't work. However, the connection got established with the third solution. (See db_connections.conf also to understand how that parameter is used.) 1.) Increase the maximum heap size, which in return will increase the maximum direct memory size. You will need to refer to the application's documentation for instructions on how to configure this value because it is application-specific. If you were starting the application using the java command then any of the following JVM arguments will set the maximum heap size to 1 GB: -Xmx1048576k -Xmx1024m -Xmx1g 2.) Explicitly increase the maximum direct memory size. E.g., the following JVM sets the value to 1 GB: -XX:MaxDirectMemorySize=1g 3.) If for any reason you do not have any control over the amount of memory you can allocate to your JVM (e.g., you are limited by the size of the container you're running in and it cannot be configured) then change the query result set from ARROW to JSON. You can pass this setting as a connection parameter using your JDBC driver: JDBC_QUERY_RESULT_FORMAT=JSON Final db_connections.conf and db_connection_types.conf local/db_connection_types.conf [snowflake] displayName = Snowflake serviceClass = com.splunk.dbx2.DefaultDBX2JDBC jdbcDriverClass = net.snowflake.client.jdbc.SnowflakeDriver jdbcUrlFormat = jdbc:snowflake://<host>:<port>/?db=<database> ui_default_catalog = $database$ port = 443 local/db_connections.conf [Snowflake_DB] connection_properties = {"JDBC_QUERY_RESULT_FORMAT":"JSON"} connection_type = snowflake customizedJdbcUrl = jdbc:snowflake://<host>.snowflakecomputing.com:443/?user=<user_name>&db=snowflake&warehouse=<warehouse_value>&schema=public database = snowflake disabled = 0 host = <host>.snowflakecomputing.com identity = SnowflakeUser jdbcUseSSL = false localTimezoneConversionEnabled = false port = 443 readonly = false timezone = Etc/UTC   ... View more

I am aware there is an accepted answer that helped me, but the connection was not established with the message 'need further details.' However, I need to do some extra configuration to establish the connection. I followed accepted answer for jdbc driver (downloaded snowflake-jdbc-3.15.1.jar ) and to add db_connection_types.conf (don't copy and paste it from the accepted answer. see below db_connection_types.conf) However, I ran into a problem with error message : could not initialize class net.snowflake.client.jdbc.internal.apache.arrow.memory.util.MemoryUtil Followed below link to fix the issue :  https://community.snowflake.com/s/article/JDBC-OutOfDirectMemoryError I added the first two options from the above solution (you can see below in case the above link is broken or removed) to the JVM Options in connection settings with a space delimiter. It didn't work. However, the connection got established with the 3rd solution. (See db_connections.conf also to understand how that parameter is used.)   1.) Increase the maximum heap size, which in return will increase the maximum direct memory size. You will need to refer to the application's documentation for instructions on how to configure this value because it is application-specific. If you were starting the application using the java command then any of the following JVM arguments will set the maximum heap size to 1 GB: -Xmx1048576k -Xmx1024m -Xmx1g 2.) Explicitly increase the maximum direct memory size. E.g., the following JVM sets the value to 1 GB: -XX:MaxDirectMemorySize=1g 3.) If for any reason you do not have any control over the amount of memory you can allocate to your JVM (e.g., you are limited by the size of the container you're running in and it cannot be configured) then change the query result set from ARROW to JSON. You can pass this setting as a connection parameter using your JDBC driver: JDBC_QUERY_RESULT_FORMAT=JSON     Final confs are as below:      local/db_connection_types.conf [snowflake] displayName = Snowflake serviceClass = com.splunk.dbx2.DefaultDBX2JDBC jdbcDriverClass = net.snowflake.client.jdbc.SnowflakeDriver jdbcUrlFormat = jdbc‌‌//:/?db= ui_default_catalog = $database$ port = 443 local/db_connections.conf [Snowflake_DB] connection_properties = {"JDBC_QUERY_RESULT_FORMAT":"JSON"} connection_type = snowflake customizedJdbcUrl = jdbc‌‌//.snowflakecomputing.com:443/?user=&db=snowflake&warehouse=&schema=public database = snowflake disabled = 0 host = .snowflakecomputing.com identity = SnowflakeUser jdbcUseSSL = false localTimezoneConversionEnabled = false port = 443 readonly = false timezone = Etc/UTC       ... View more

As of version  7.4.1 your org cert must be appended to below path:  $SPLUNK_HOME/etc/apps/Splunk_TA_aws/lib/certifi/cacert.pem ... View more

If your Splunk version is 9.2 and above and running on Linux.  You could try below  https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Serverconf         ... View more

| makeresults | eval _raw="{ \"timeStamp\": \"2024-02-29T10:00:00.673Z\", \"collectionIntervalInMinutes\": \"1\", \"node\": \"plgiasrtfing001\", \"inboundErrorSummary\": [ { \"name\": \"400BadRequestMalformedHeader\", \"value\": 1 }, { \"name\": \"501NotImplementedMethod\", \"value\": 2 }, { \"name\": \"otherErrorResponses\", \"value\": 1 } ] }| { \"timeStamp\": \"2024-02-29T10:00:00.674Z\", \"collectionIntervalInMinutes\": \"1\", \"node\": \"plgiasrtfing001\", \"inboundErrorSummary\": [ { \"name\": \"400BadRequestMalformedHeader\", \"value\": 10 }, { \"name\": \"501NotImplementedMethod\", \"value\": 5 }, { \"name\": \"otherErrorResponses\", \"value\": 6 } ] }" | makemv _raw delim="|" | rename _raw as raw | mvexpand raw | rex field=raw "timeStamp\"\: \"(?<_time>[^\"]+)" | rename raw as _raw ```Below is the SPL you need potentially``` | spath inboundErrorSummary{} | mvexpand inboundErrorSummary{} | spath input=inboundErrorSummary{} | chart values(value) over _time by name ... View more

If you were to use iseval = 1. you must specify definition of the macro within double quotes "". Because Splunk is expecting string in the definition example definition  "round('$field$',$decimal$)" ... View more

you are 200% correct.  to use iseval = 1  we must specify the definition within double quotes.  ... View more

just deleting the cacert.pem and privkey.pem and restart splunk serive will create a new cert.  ... View more

That's only available in Splunk Cloud.  ... View more

I faced the exact same issue in one of the multi-site indexer clusters when I upgraded the indexer cluster from version 9.0.x to 9.0.5. After upgrading Splunk on the indexer, the virtual machine (VM) running the indexer unexpectedly went down. When I restarted the VM, I discovered that the Splunk service was already running, and the version displayed was the latest one. However, I failed to notice that it was experiencing problems connecting to the cluster manager. I completed the upgrade, but after a few days (around 15 days), the vulnerability management team requested another Splunk version upgrade. When I checked the Splunk version using the command, it displayed version 9.0.5. However, upon inspecting the $SPLUNK_HOME/etc/splunk.version file, I found that it still had the old version, indicating an unsuccessful upgrade. Realizing this, put the cluster master in maintenance mode, I stopped the Splunk service on the faulty indexer, cleared the standalone buckets using the commands mentioned below. Unfortunately, while restarting the Splunk service on the faulty indexer, the server went down again.   # finding standaralone buckets find $SPLUNK_DB/ -type d -name "db*" | grep -P "db_\d*_\d*_\d*$" #converting standardalone buckets to clustered buckets # 5A0E298B-0AFB-4d56-9dD0-A64dfdfd19DA8 is the GUID of cluster manager(master) find $SPLUNK_DB/ -type d -name "db_*" | grep -P "db_\d*_\d*_\d*$" |xargs -I {} mv {} {}_5A0E298B-0AFB-4d56-9dD0-A64dfdfd19DA8 I repeated this process two to three times, but it did not resolve the issue. Finally, I cleared the $SPLUNK_HOME/etc/instances.cfg file on the faulty indexer and restarted the service. This time, the indexer successfully joined the cluster. ... View more

I faced the exact same issue in one of the multi-site indexer clusters when I upgraded the indexer cluster from version 9.0.x to 9.0.5. After upgrading Splunk on the indexer, the virtual machine (VM) running the indexer unexpectedly went down. When I restarted the VM, I discovered that the Splunk service was already running, and the version displayed was the latest one. However, I failed to notice that it was experiencing problems connecting to the cluster manager. I completed the upgrade, but after a few days (around 15 days), the vulnerability management team requested another Splunk version upgrade. When I checked the Splunk version using the command, it displayed version 9.0.5. However, upon inspecting the $SPLUNK_HOME/etc/splunk.version file, I found that it still had the old version, indicating an unsuccessful upgrade. Realizing this, put the cluster master in maintenance mode, I stopped the Splunk service on the faulty indexer, cleared the standalone buckets using the commands mentioned below. Unfortunately, while restarting the Splunk service on the faulty indexer, the server went down again. # finding standaralone buckets find $SPLUNK_DB/ -type d -name "db*" | grep -P "db_\d*_\d*_\d*$" #converting standardalone buckets to clustered buckets # 5A0E298B-0AFB-4d56-9dD0-A64dfdfd19DA8 is the GUID of cluster manager(master) find $SPLUNK_DB/ -type d -name "db_*" | grep -P "db_\d*_\d*_\d*$" |xargs -I {} mv {} {}_5A0E298B-0AFB-4d56-9dD0-A64dfdfd19DA8 I repeated this process two to three times, but it did not resolve the issue. Finally, I cleared the $SPLUNK_HOME/etc/instances.cfg file on the faulty indexer and restarted the service. This time, the indexer successfully joined the cluster. ... View more

I faced the exact same issue in one of the multi-site indexer clusters when I upgraded the indexer cluster from version 9.0.x to 9.0.5. After upgrading Splunk on the indexer, the virtual machine (VM) running the indexer unexpectedly went down. When I restarted the VM, I discovered that the Splunk service was already running, and the version displayed was the latest one. However, I failed to notice that it was experiencing problems connecting to the cluster manager. I completed the upgrade, but after a few days (around 15 days), the vulnerability management team requested another Splunk version upgrade. When I checked the Splunk version using the command, it displayed version 9.0.5. However, upon inspecting the $SPLUNK_HOME/etc/splunk.version file, I found that it still had the old version, indicating an unsuccessful upgrade. Realizing this, put the cluster master in maintenance mode, I stopped the Splunk service on the faulty indexer, cleared the standalone buckets using the commands mentioned below. Unfortunately, while restarting the Splunk service on the faulty indexer, the server went down again.   # finding standaralone buckets find $SPLUNK_DB/ -type d -name "db*" | grep -P "db_\d*_\d*_\d*$" #converting standardalone buckets to clustered buckets # 5A0E298B-0AFB-4d56-9dD0-A64dfdfd19DA8 is the GUID of cluster manager(master) find $SPLUNK_DB/ -type d -name "db_*" | grep -P "db_\d*_\d*_\d*$" |xargs -I {} mv {} {}_5A0E298B-0AFB-4d56-9dD0-A64dfdfd19DA8   I repeated this process two to three times, but it did not resolve the issue. Finally, I cleared the $SPLUNK_HOME/etc/instances.cfg file on the faulty indexer and restarted the service. This time, the indexer successfully joined the cluster. ... View more

I used alert_logevent alert action to ingest events from custom alert action, you may try below : from future.moves.urllib.parse import urlencode from future.moves.urllib.request import urlopen, Request from future.moves.urllib.error import HTTPError, URLError from splunk.util import unicode def log_event(helper, event, source, sourcetype, host, index): if event is None: helper.log_error("ERROR No event provided\n") return False query = [('source', source), ('sourcetype', sourcetype), ('index', index)] if host: query.append(('host', host)) url = '%s/services/receivers/simple?%s' % (helper.settings['server_uri'], urlencode(query)) try: encoded_body = unicode(event).encode('utf-8') req = Request(url, encoded_body, {'Authorization': 'Splunk %s' % helper.settings['session_key']}) res = urlopen(req) if 200 <= res.code < 300: helper.log_debug("receiver endpoint responded with HTTP status=%d\n" % res.code) return True else: helper.log_error("receiver endpoint responded with HTTP status=%d\n" % res.code) return False except HTTPError as e: helper.log_error("Error sending receiver request: %s\n" % e) except URLError as e: helper.log_error("Error sending receiver request: %s\n" % e) except Exception as e: helper.log_error("Error %s\n" % e) return False def your_def_like_to_ingest_events(): success = log_event( helper, event=data_url_final, source=source, sourcetype=sourcetype, host=host, index=index ) if not success: sys.exit(2) Note: only one event per call to log_event will be ingested.  if you want to ingest multiple events then you need to call log_event multiple times.   ... View more

@vik Did you try my solution? ... View more

Congratulations to all the Splunk MVP members.  ... View more

Yes. ... View more

From UI: you can try dump command. choose the time range for which you want to export the logs. Make sure you have enough storage available in the server.  index=<index_name> | dump basefilename=dump_<index_name>   basefilename will be saved under $SPLUNK_HOME/var/run/splunk/dispatch/<search_job_id>/dump/basefilename_<some_number>_<hour>.raw.gz Note: Splunk generates 1 dump for 1 hour. if you have selected 24hours time range then you will see 24 or 25 files.  ... View more

Splunk will migrate and upgrade kvstore automatically if the instance is running in standard alone mode.  if Splunk instance is involved in any clustering ( search head , indexer ) then kvstore has to be manually migrated and upgraded. this applies to Deployer as well.  there is no need of changing storageEngineMigration = true if you follow below link. https://docs.splunk.com/Documentation/Splunk/9.0.2/Admin/MigrateKVstore?ref=hk In search head cluster, its 3 step process.   #verify if kvstore can be migrated by running below command splunk start-shcluster-migration kvstore -storageEngine wiredTiger -isDryRun true #initiate migrate /opt/splunk/bin/splunk start-shcluster-migration kvstore -storageEngine wiredTiger #wait until it compltes, you can check status splunk show shcluster-kvmigration-status #initiate upgrade splunk start-shcluster-upgrade kvstore -version 4.2 #wait until it completes, you can check status splunk show kvstore-status --verbose output once it's completed KVStore Migration Status: migrationStatus: kvstore_migration_completed Start Time: Fri Nov 4 08:50:16 2022 End Time: Fri Nov 4 08:55:06 2022 Migration ID: 1667537416 Peer Retries: 1 Cluster Percentage: 100 Storage Engine: wiredTiger Peer Status List: https://sh1:8089: migrationStatus: succeeded https://sh2:8089: migrationStatus: succeeded https://sh3:8089: migrationStatus: succeeded #finally remove unnecessary files Delete the following files from the $SPLUNK_HOME/bin directory: mongod-3.6 mongod-4.0 mongodump-3.6 mongorestore-3.6       ... View more

SQS notification can be created from both the ways. But Splunk add-on for aws is designed in way that has dependency to validate signature of the object. ... View more

CURRENT APPLICATION Splunk Add-on for AWS Version: 6.2.0 Build: 1658820915   Simple Architecture: Expected process by Splunk Add-on for AWS is as below: 1. Enable/configure cloud trail logs to s3 bucket and enable SNS topic  2. create standard SQS queue ( This queue will be used as Dead Letter queue in SQS queue creation of 3rd step) 3. Create standard SQS queue with below configuration Make sure your SQS queues have same configuration as below (except name, because your SQS will have different name) DLQ Configuration for SQS created in step 3 : Choose queue created in 2 step.  after creating the queue from step 3 . open queue created from step 3 and subscribe to SNS topic Modify SQS created in step 3 Policy   { "Version": "2008-10-17", "Id": "__default_policy_ID", "Statement": [ { "Sid": "__owner_statement", "Effect": "Allow", "Principal": "*", "Action": "SQS:*", "Resource": "<arn:aws:sqs:us-east-1:000000000000:this-sqs-queue>", "Condition": { "ArnEquals": { "aws:SourceArn": "<arn:aws:sns:us-east-1:000000000000:your-sns-topic" } } }   4. Above enabled SNS topic will be subscribed by SQS Below is the SNS Access policy : easiest way to get this policy created is to create SNS topic while enabling SNS in cloud trail log setup.      { "Version": "2008-10-17", "Id": "__default_policy_ID", "Statement": [ { "Sid": "__default_statement_ID", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "SNS:GetTopicAttributes", "SNS:SetTopicAttributes", "SNS:AddPermission", "SNS:RemovePermission", "SNS:DeleteTopic", "SNS:Subscribe", "SNS:ListSubscriptionsByTopic", "SNS:Publish" ], "Resource": "<arn:aws:sns:us-east-1:0000000000:sns-topic>", "Condition": { "StringEquals": { "AWS:SourceOwner": "<account_id>" } } }, { "Sid": "AWSCloudTrailSNSPolicy20150319", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "SNS:Publish", "Resource": "<arn:aws:sns:us-east-1:0000000000:sns-topic>", "Condition": { "StringEquals": { "AWS:SourceArn": "<arn:aws:cloudtrail:us-east-1:0000000000:trail/cloudtrail-events>" } } } ] }   5. Create IAM Policy ( Added permissions based on my best knowledge and keeping least privilege in mind)  using below: Note: don't forget to change SQS and S3 ARNs   { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "sqs:ListQueues", "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "sqs:DeleteMessage", "sqs:GetQueueUrl", "s3:GetLifecycleConfiguration", "s3:GetBucketTagging", "sqs:ReceiveMessage", "s3:GetBucketLogging", "sqs:SendMessage", "sqs:GetQueueAttributes", "s3:ListBucket", "s3:GetAccelerateConfiguration", "s3:GetObject", "s3:GetBucketCORS", "s3:GetBucketLocation" ], "Resource": [ "<arn:aws:sqs:us-east-1:00000000:sqs-name>", "<arn:aws:s3:::bucket_name>", "<arn:aws:s3:::bucket_name>/*>" ] } ] }​   6. Create a new role and choose above IAM policy while creating. 7. create a user 8. In the role trust relationships add below policy to allow user to assume this role.    { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "<arn:aws:iam::00000000000:user/created_in_step7>" }, "Action": "sts:AssumeRole", "Condition": {} } ] }   Note: don't try to copy and paste the above policy. some characters are will not be copied properly. especially IAM policy where it gives s3 permission to resource object "buket_arn/*" ... View more

same in version 4.1.1 ... View more

what you are assuming is correct for hashing not for encyrpting and decrypting. ... View more

@jeffland Thanks for the solution. That's exactly what I was looking for.  https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/PanelreferenceforSimplifiedXML#input_.28form.29 ... View more

@suzakutheknight @HiMAT-Mode  appreciate if you post new question about AWS TA. The current question is all about ec2 and s3. ... View more