Getting Data In

Eventtypes have gone missing

kmower
Communicator

I have had Splunk Stream up and running for a while, but after upgrading to 7.3.1 some of my Eventtypes that drive the Stream dashboards seem to have gone AWOL. For example, I am mainly using Stream to monitor my sql database activity (tds). The Admin dashboard for databases used to work just fine, but now it is throwing the error: Eventtype 'stream_agg_databases' does not exist or is disabled.

I checked the Eventtypes after reading a post that said sometimes Eventtypes are disabled on upgrades, but this one is gone altogether. So I was wondering if anyone knows how to restore the Eventtypes for Stream? Thanks.

Tags (1)
0 Karma
1 Solution

kmower
Communicator

OK, I have answered this myself. The permissions for the Event Types for Splunk_TA_stream were restricted to 'The App' which is Splunk_TA_Stream, bit of course the Stream App is splunk_stream_app ... So the fix is to enable the Permissions for All apps so that splunk_stream_app can access the Event Types.

View solution in original post

0 Karma

kmower
Communicator

OK, I have answered this myself. The permissions for the Event Types for Splunk_TA_stream were restricted to 'The App' which is Splunk_TA_Stream, bit of course the Stream App is splunk_stream_app ... So the fix is to enable the Permissions for All apps so that splunk_stream_app can access the Event Types.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...