Hi, when we try to create a dblookup, based up DB Connect v2, out of a tableview from an Oracle DB with 33 million entries we always get the following error message, after we execute a splunk query that uses the lookup: 09-14-2016 14:59:05.855 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py bic_testlookup': Traceback (most recent call last): 09-14-2016 14:59:05.855 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py bic_testlookup': File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py", line 114, in <module> 09-14-2016 14:59:05.855 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py bic_testlookup': raise ex 09-14-2016 14:59:05.855 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxlookup.py bic_testlookup': RuntimeError: maximum recursion depth exceeded 09-14-2016 14:59:05.867 ERROR LookupOperator - Script for lookup table 'db_connect_bic_testlookup' returned error code 1. Results may be incorrect. With DB Connect v1 our lookup definition with the exact same database worked perfectly fine. What has been changed in v2 and how can we fix it to make it work again? Thank you in advance. ... View more

Hi, We always run into the problem where people leave our organization, we delete their account in Splunk, but want to keep their automated reports and dashboards. Is there a smart solution to move one app/dashboard/scheduled search/field/whateverelement to a new owner? Thank you in advance, Tom ... View more

Hello, I am currently trying to make Damien's Kafka Modular Input run on a Splunk Universal Forwarder 6.2.3 under RedHat 6. Unfortunately i am getting the following errors in the splunkd.log: 06-02-2015 09:33:38.282 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder". 06-02-2015 09:33:38.282 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" SLF4J: Defaulting to no-operation (NOP) logger implementation 06-02-2015 09:33:38.282 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details. We are running Python 2.6 on the host. Recommended is Python 2.7 version. Could this be the root cause? Here is our inputs.conf: # Kafka Data Inputs {{{ [kafka://kafka-hostname] additional_consumer_properties = group.id=7 auto_commit_interval_ms = 1000 group_id = 6 index = test sourcetype = kafka-test topic_name = logstash zookeeper_connect_host = zoo-hostname1,zoo-hostname2,zoo-hostname3,zoo-hostname4,zoo-hostname5 zookeeper_connect_port = 2181 zookeeper_session_timeout_ms = 400 zookeeper_sync_time_ms = 200 disabled = false # }}} When i use only one zoo-host and leave the following lines out: additional_consumer_properties = group.id=7 auto_commit_interval_ms = 1000 group_id = 6 i get different error messages in the splunkd.log: 06-02-2015 11:06:15.242 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.consumer.ZookeeperConsumerConnector.kafka$consumer$ZookeeperConsumerConnector$$registerConsumerInZK(ZookeeperConsumerConnector.scala:226) 06-02-2015 11:06:15.242 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.consumer.ZookeeperConsumerConnector.consume(ZookeeperConsumerConnector.scala:211) 06-02-2015 11:06:15.242 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.javaapi.consumer.ZookeeperConsumerConnector.createMessageStreams(ZookeeperConsumerConnector.scala:80) 06-02-2015 11:06:15.242 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.javaapi.consumer.ZookeeperConsumerConnector.createMessageStreams(ZookeeperConsumerConnector.scala:92) 06-02-2015 11:06:15.243 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at com.splunk.modinput.kafka.KafkaModularInput$MessageReceiver.run(Unknown Source) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" Stanza kafka://kafka-dev-290687.lhotse.ov.otto.de : Error running message receiver : java.lang.IllegalArgumentException: Invalid path string "/consumers//ids/_kafka-dev-290687-1433235975245-76b9eb2e" caused by empty node name specified @11 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.apache.zookeeper.common.PathUtils.validatePath(PathUtils.java:99) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.apache.zookeeper.common.PathUtils.validatePath(PathUtils.java:35) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.apache.zookeeper.ZooKeeper.create(ZooKeeper.java:626) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkConnection.create(ZkConnection.java:87) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient$1.call(ZkClient.java:308) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient$1.call(ZkClient.java:304) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient.retryUntilConnected(ZkClient.java:675) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient.create(ZkClient.java:304) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at org.I0Itec.zkclient.ZkClient.createEphemeral(ZkClient.java:328) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.utils.ZkUtils$.createEphemeralPath(ZkUtils.scala:253) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.utils.ZkUtils$.createEphemeralPathExpectConflict(ZkUtils.scala:268) 06-02-2015 11:06:15.248 +0200 ERROR ExecProcessor - message from "python /var/opt/splunk/etc/apps/kafka_ta/bin/kafka.py" at kafka.utils.ZkUtils$.createEphemeralPathExpectConflictHandleZKBug(ZkUtils.scala:306) What am i doing wrong in my configuration? Please help. ... View more

Hello, we want to calculate some Requesttimes vs. Requestnumbers. What we do is source=ourdata.log | timechart span=1h sum(duration) as impact count(ws-method) by domain Now we want to search in the same log for source=ourdata.log | stats (count) ws-method="thespecialmessage" With the results from the second search, we want to divide the results from the first query. how can we do that? This seems to be a multidimensional search... ... View more

Hi, we have a Splunk 5 system running. When we try to do a search via the REST API, we get debug output information back. When we do the search a second time, we get the results of the search. What are we doing wrong here? Splunk SEARCH: source="/var/opt/tomcat/logs/tomcat_access.log" fooo_group=foofoofoo | timechart span=10s avg(runtime) by fooo_tical CODE: package de.fooo.jenkinsci.plugins.splunker; import de.fooo.jenkinsci.utils.IOMagic; import org.apache.commons.io.FilenameUtils; import java.io.File; import java.text.DateFormat; import java.text.SimpleDateFormat; import java.util.ArrayList; import java.util.Date; import java.util.List; final class SplunkSearch { private static final String SPLUNKRESULTDATAFILENAME = "splunkresultdata.csv"; // 2013-02-08T11:40:58-0100 private static final DateFormat splunkDateFormat = new SimpleDateFormat("yyyy-MM-dd'T'hh:mm:ssZ"); private final String splunkServerUrl; private final String userName; private final String password; SplunkSearch(String splunkServerUrl, String userName, String password) throws Exception { this.splunkServerUrl = splunkServerUrl; this.userName = userName; this.password = password; // TODO test connection // curl -k -u fkt_foofoo:splunkfooword // https://fooo-splunk-foonet.de:8089/services/authentication/users } File search(String search, Date from, Date now) throws Exception { File datafile; if (search.startsWith("SELFTEST")) { datafile = IOMagic.saveFileFromClasspath("/scripts/statistic/demodata/" + search + ".csv", search, ".csv"); } else { System.out.println("---------------------------------------------------------------- 1"); List<String> command = new ArrayList<String>(); command.add("curl"); command.add("-vs"); command.add("-k"); command.add("-u"); command.add(userName + ":" + password); command.add(splunkServerUrl); command.add("-d"); command.add("output_mode=csv"); command.add("--data-urlencode"); command.add("search=search " + search); command.add("-d"); command.add("earliest_time=\"" + splunkDateFormat.format(from) + "\""); command.add("-d"); command.add("latest_time=\"" + splunkDateFormat.format(now) + "\""); command.add("-d"); command.add("exec_mode=\"oneshot\""); command.add("-o"); File tmpfile = File.createTempFile(FilenameUtils.getBaseName(SPLUNKRESULTDATAFILENAME), "." + FilenameUtils.getExtension(SPLUNKRESULTDATAFILENAME)); command.add(tmpfile.getAbsolutePath()); ProcessBuilder pb = new ProcessBuilder(); pb.command(command); pb.start(); try { Thread.sleep(10000); } catch (InterruptedException e) { e.printStackTrace(); } // Avoid empty first line datafile = File.createTempFile(FilenameUtils.getBaseName(SPLUNKRESULTDATAFILENAME), "." + FilenameUtils.getExtension(SPLUNKRESULTDATAFILENAME)); IOMagic.removeEmptyLines(tmpfile, datafile); } if (datafile.length() == 0) { throw new Exception("Data file from Splunk is empty."); } return datafile; } } ... View more

Hi, i created a search, to get an overview of the license volume usage in our Splunk system. index="_internal" source="*metrics.log" per_sourcetype_thruput | eval GBytes=((kb/1024)/1024) | timechart span=1d sum(GBytes) as GBytes by series The search is being accelerated and should give me data for 90 days. A dashboard that is based on this, only shows 10 days of data. What are we doing wrong? We have a similar sitation with other data and accelerated searches. Data is only viewable for the last 7 - 10 days and than no data. Thank you, Thomas ... View more