recently upgraded my splunk HF with Splunk enterprise 9.1 version. Also upgraded Splunk TA add-on for New Relic. Privious TA version 2.1.0 New TA version 2.1.6 after the upgrade TA is not able to make api call to new relic and failing with error invalid api key. I confirmed the api key is correct and I am able to call it feom other client. ... View more

Hi, I have sourcetype "abc" which has few days data. Now we have decided to modified the sourcetype name to def . I have made the required changes and data is coming to the new sourcetype. I just want to know how I could copy old sourcetype data to the new one. Kindly help. ... View more

I am using | dbquery to get the lookup details and outputlookup to generate the lookup file, but it always generates under different app (either system/lookup or app/dbx/lookup). I am trying to run the query in a search from a different app, say SampleApp. Please let me how I can create the lookup under SampleApp? or is there any config file I need to change or any command to move the file under a certain app? ... View more

I am trying to create a package for my app. I am using a linux server where splunk is installed. as i got the information from this portal, i open the directory /opt/splunk/etc/apps/framework and execute the command ./splunkdj package App_name. when i execute the command, it asks me Where is Splunk installed (version 5.0 or later is required)? []: I am confused which path i should give here. I tried using the path $splunk_home$/bin , but no luck. Please suggest ... View more

I am passing a parameter from main dashboard to next view. I want to show that parameter to the user in the label or input type field. If i use Input type="text" , it becomes editable. I want to make this field read only. i have used readonly="readonly" in, but it's not working . please help. ... View more