Seeing the same behavior as well, is there a plan to fix this? Seeing the issue in app version 2.0.2 on splunk 7.3.1.1, other pages work but job insights just returns a blank until i switch to en-us ... View more

I think this is an issue with the way the timechart command is transforming the data. As you are looking over a large time range (6 months) the events are being bucketed into 1 day chunks so that they can be displayed nicely. You can test this by looking at the statistics tab after running the search using non-si commands and looking at the _time field in the returned events If this isnt the desired behavior you could look at using a stats command instead to avoid any of the timestamp changes associated with timechart but at the end of the day the whole point of summary indexing is to summarise the data over a period so it makes sense to keep it bucketed as it is. ... View more

Hi all, Im seeing similar behaviour to this in my 6.3 instance, is it meant to act like this? Its not ideal to have to repair the bucket every time you add new summary indexed events... ... View more

Hi Murali I had alot of issues with my subsearches but i found the best way to get back multiple fields from from a subsearch was using Eval (making sure the results are returned using a field called 'query' (dont ask me why)) and then rex ing out your fields from the result. Its not very elegant but it gives you visibility and control over the data you are returning. Im not very good at written explanations so maybe a code example would help: eval f=[search A | fields B,C | eval query=B+";"+C | table query ] | rex (insert splitting regex here) | search (D OR E) | fields F | table, B,C,F ... View more

Thanks, that gets rid of the error! The only issue now is that i'm not sure it is only allowing events where the messagesender is in the csv referenced by the inputlookup (as it is instantly returning "no results found") ... View more

Hi Frobinson, we use DBX version 1.17 And to clarify our splunk SME was able to recreate the issue but was able to get around it by changing the job in the inputs.conf file after the job had been created using an acceptable cron. ... View more

File "F:\Program Files\Splunk\etc\apps\dbx\bin\rest_handler_dbmon.py", line 126, in validateConfig\r\n executeBridgeCommand("com.splunk.dbx.monitor.DatabaseMonitorValidator", args, checkStatus=True)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\spp\java\bridge.py", line 182, in executeBridgeCommand\r\n raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\r\nJavaBridgeError: Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17\r\n\r\n 04-23-2015 11:10:37.261 +0100 ERROR AdminManagerExternal - Unable to xml-parse the following data: Failed to validate: com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza dbmon-tail://RT... See splunkd.log for full data. ... View more

An interesting sidenote: one of our splunk SMEs tried using the */5 * * * * notation in the inputs.conf file and the job seems to run successfully... Here is the error output from entering it in the GUI: 04-23-2015 11:10:37.261 +0100 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza dbmon-tail://RTVP/EMSTopicStatus\r\r\nfalse<class 'spp.java.bridge.JavaBridgeError'>Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17Traceback (most recent call last):\r\n File "F:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 70, in init\r\n hand.execute(info)\r\n File "F:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 528, in execute\r\n if self.requestedAction == ACTION_EDIT: self.handleEdit(confInfo)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\spp\config.py", line 238, in handleEdit\r\n self.handleModification("edit", output)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\spp\config.py", line 218, in handleModification\r\n id, props = self.process_modification(id, props, type=type, output=output)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\rest_handler_dbmon.py", line 95, in process_modification\r\n self.validateConfig(stanza, props)\r\n (to be continued) ... View more

Hi MuS, Im getting a similar issue, when i try and use */5 * * * * as the cron expression for a database input i get the error: Encountered the following error while trying to update: In handler 'dbx-monitors': Unable to xml-parse the following data: Failed to validate: com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza dbmon-tail://RT... See splunkd.log for full data. I have tried this on 3 different servers and i get the same error every time. the only way i can get multiple runs in an hour is to use comma delimited notation ... View more

@Maciep: Its an oracle database, and sorry I should clarify the project I am working on requires the dashboard to be populated from an index so the this syntax is now obsolete, I just thought it would be useful to show a working example of what im trying to replace. @Rsennet_splunk: He is the syntax of the dropdown box. <input type="multiselect" token="field1"> <label>Service</label> <selectFirstChoice>true</selectFirstChoice> <populatingSearch fieldForValue="name" fieldForLabel="name">index="collectivequeue" | eval StartTime = relative_time(NOW(),"-1d") | where (StartTime &lt; time_stamp) | rename time_stamp as _time | sort +_time +name | dedup name | table name</populatingSearch> </input> From what I can tell the token is a string of all the selected names (separated by spaces) which explains why I can use the '$Names_tok$' like '%'||"name"||'%' syntax in my oracle query. Basically this question boils down to how can I filter the results I'm getting back by comparing the name field in each event with a string containing lots of names. I believe the only place this is possible would be in the where clause but I am unable to use wildcards/regex in this section to allow name to match a string containing that name (the token). ... View more

Nope, the script is written in powershell and uses a logging module (http://gallery.technet.microsoft.com/scriptcenter/Write-timestamped-output-4ff1565f) to push lines to the file. I used a file handle reader in my error handling and the only process that had access to the file having issues was splunk forwarder which had it open with full (RWD) access. Im taking a look at the logging module to see if the way it saves could be the culprit ... View more