Hi Experts, I use the following macro, and it works perfectly fine with admin role until I created new users (with limited capabilities of course) and I noticed it does not work for them. Any clue what capabilities that I should enable for other users to use the macro? Sample macro [macro_number_one(1)] args = type definition = case("$type$"="main", "index=some_index_01", "$type$"="itsm", "index=some_index_01", 1=1, "index=some_index_01") iseval = 1 results are only displaying the macro name on the panel: macro_number_one ... View more

Hi Experts, I currently suspect that one of the existing Splunk DB Connect 2 Operations job keep failing to retrieve the data due to the errors below. This is causing data lagging for 10 hours. Anyone have a solution for this? 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Traceback (most recent call last): 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" File "C:\Program Files\Splunk\Python-2.7\Lib\logging\handlers.py", line 77, in emit 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" self.doRollover() 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" File "C:\Program Files\Splunk\Python-2.7\Lib\logging\handlers.py", line 142, in doRollover 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" os.rename(self.baseFilename, dfn) 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" WindowsError: [Error 32] The process cannot access the file because it is being used by another process 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Logged from file health.py, line 186 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Traceback (most recent call last): 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" File "C:\Program Files\Splunk\Python-2.7\Lib\logging\handlers.py", line 77, in emit 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" self.doRollover() 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" File "C:\Program Files\Splunk\Python-2.7\Lib\logging\handlers.py", line 142, in doRollover 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" os.rename(self.baseFilename, dfn) 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" WindowsError: [Error 32] The process cannot access the file because it is being used by another process 09-15-2015 12:00:46.469 +0800 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\mi_input.py"" Logged from file health.py, line 193 ... View more

Hi Experts, The case is: I have 2 join clauses where the source of _time on the first search uses date_created , while the source of _time of second search uses last_updated What is the impact on my search result if I use the time picker to select the range of the data? pseudo search as follows: index=index01 sourcetype=sourcetype_01 | join type=left order_id [search index=index01 sourcetype=sourcetype_02] | table _time order_id status order_created_dt last_updated_dt activity_id activity_status Sample data: sourcetype=sourcetype_01 order_id order_created_dt status last_updated_dt 123 9/1/2015 0:00 Processing 9/2/2015 0:10 sourcetype=sourcetype_02 order_id activity_id activity_status last_updated_dt 123 A001 Open 9/2/2015 0:11 123 A002 Completed 9/2/2015 0:15 123 A003 Open 9/2/2015 0:11 props.conf [sourcetype_01] INDEXED_EXTRACTIONS=csv TIMESTAMP_FIELDS ="order_created_dt" [sourcetype_02] INDEXED_EXTRACTIONS=csv TIMESTAMP_FIELDS ="last_updated_dt" ... View more

Hi Experts, I notice another problem on Splunk DB Connect 2 where the health monitoring stops generating results. Current recorded transactions count is 3084 hits. This causes difficulties to monitor the performance of the SQL and the errors that may occur during the time queries are executed. Any idea how do I enable this back or clear the past transactions if that would help to bring back the health monitoring? Cheers! ... View more

Hi Experts, Apparently, I noticed this issue while using SPLUNK DB Connect 2 with behavior as following: Use DB Connect 2 to poll the data SQL as follows: select order_id, date_created, to_char(date_created, 'mm/dd/yyyy hh24:mi:ss') as dt_created, to_date(last_updated, 'mm/dd/yyyy hh24:mi:ss') as last_upd_dt, status from table_name where last_updated > sysdate -1 I choose column date_created as DB Connect 2 will read this returned field as epoch time. Selected timeformat YYYY-MM-dd HH:mm:ss And finalizing the setup with cron job and the stuffs. Practice above was gave me approx 99 mb data that I can notice from the index size on the first polling. When I do data verification by use of following search formula, I noticed not all _time consumed the date_created that I chose earlier. Here is the search sample to validate: index=sample_index | table _time, date_created, dt_created This issue causes deviations for most of the panels/charts that I created earlier, and to fix the dashboard as the workaround is not a good choice as most of the time pickers would not work at all, and it will ended in extra cost of extended development and code maintenance. My question is: Is there anyone was had the same issue as above? If so did you manage to get the workaround to fix the issue? How? Or if the developer of SPLUNK DB Connect 2 reads this, could you confirm this on your side and tell us what should we do to fix that issue? Thanks a lot and appreciate on your responses. ... View more