As of version  7.4.1 your org cert must be appended to below path:  $SPLUNK_HOME/etc/apps/Splunk_TA_aws/lib/certifi/cacert.pem ... View more

Settings on the SH as follows: AUTO_KV_JSON = false KV_MODE = none   Settings on the HF: AUTO_KV_JSON = false INDEXED_EXTRACTIONS = json KV_MODE = none   Values are getting duplicated, do you have anymore suggestions for us ? ... View more

I have an angular 16 application also facing same issue. ... View more

I has read about this little bit more and to be honest I couldn't found a clear answer and any reason why this has worked like that way.  App/user configuration files said that app.conf is for user/app level only. You cannot use it for global configurations, BUT still the instructions said that you should put it into etc/system/local/app.conf to use it as a global (Set the deployer push mode). This is quite confusing! And actually that file is on deployer on path etc/shcluster/apps/<app> not in etc/apps/<app> which basically means that it's hasn't merged(/affected) with other app files when bundle has applied  (read: created) on deployer. Precedence has used only for files under etc/apps/<app> + etc/system if I have understood right. Usually when you have created your own app you set all configurations into default not a local directory. This should haven't have any other side effect, than where it has put, when bundle has applied into SHC members. Of course also e.g. pass4SymmKeys etc. is crypted (and plain text has removed) only on those files, which are in local! If you have some apps e.g. from splunkbase, then you should put your local changes under local directory, avoid to lost those, when you update that app to the newer version. But it shouldn't depend that way based on where app.conf is default vs. local. If this has some side effects then it should mentioned on docs. I haven't seen any mention that default vs local has used for setting global vs. local values. It's only the precedence which those are used. Definitely this needs some feedback to doc team. BTW: @pmerlin1 you said that you have migrated from SH to SHC. Have you followed the instructions and use only clean and new SH as a members on this SHC not reuse (without cleaning) the old SH? ... View more

Hi @Praz_123 , Can you check your authentication.conf file and confirm you are using LDAP and also start checking the splunkd.log and see what errors appears related to login to debug further.  ... View more

Hi, did you find any viable solution to this problem ? ... View more

Were you able to fix this ? Please share solution. Thanks ... View more

If you want download  the app config explorer in that you can run such things like btool and other things on UI Be generous and leave a like if it helps 🙂   ... View more

Somebody might want to repost the info above as I submitted a deletion request; after that completes I don't know if my posts will remain. Just so it doesn't get lost. ... View more

Hi @ChintanaM ,   I am also new to react but have stated  to watch below session to get me going. https://conf.splunk.com/files/2021/recordings/DEV1134A.mp4  and Also this page is really a good start. https://bestofreactjs.com/repo/zepdev-kveditor-react-rich-text-editing ... View more

@rdelhorbe @dm1 , If you are running Splunk as systemd service, then it would be better if you use below command to stop SPLUNK.   systemctl stop Splunkd ( # Stop Splunk )  systemctl status Splunkd ( # Status Splunk ) systemctl start Splunkd ( # Start Splunk ) If you have not setup SPLUNK properly to run as systemd service you would need to login with root user to stop it.  Refer this page for more details as how to properly configure Splunk to run as systemd service.  https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/RunSplunkassystemdservice ... View more

@mlevsh , This question is already answered in the past.  Can you please look into below link and see that helps.  Ignoring-any-data-record-that-begins-with-a-quot-quot-character You can do this with props and Transforms as mentioned in the above post.  ... View more

BTW, if this is a peer in indexer cluster or heavy forwarder then it's best practice to keep web GUI down for security reasons. https://docs.splunk.com/Documentation/Splunk/8.2.3/Security/WhatyoucansecurewithSplunk ... View more

@Splunk_rocks  Your search isn't completely working as the rex command it doesn't extract the values. So the search should look as follows:   | rest /services/server/introspection/kvstore/collectionstats | mvexpand data | spath input=data | rex field=ns "^(?<App>.+)\.(?<Collection>.+)$" | eval dbsize=round(size/1024/1024, 2) | eval indexsize=round(totalIndexSize/1024/1024, 2),dbsizegb=round(dbsize/1024, 2) | stats first(count) AS "Number of Objects" first(nindexes) AS Accelerations first(indexsize) AS "Acceleration Size (MB)" first(dbsize) AS "Collection Size (MB)" first(dbsizegb) as "Collection Size (GB)" by App, Collection   ... View more

Hello, I am curious if you have found another way to accomplish this.    For us, going through audit functions to a blob storage on a heavily used azure sql database is beyond painful and completely impractical.    ... View more

Never use the break_* settings. Try this: [bash_history] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+[\s#]*) TIME_PREFIX = ^ TIME_FORMAT = %s MAX_TIMESTAMP_LOOKAHEAD = 10 But that is probably not your problem. If you are sure that your settings are correct, it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier) UNLESS you are using HEC's JSON endpoint (it gets pre-cooked) or INDEXED_EXTRACTIONS (configs go on the UF in that case), then restart all Splunk instances there. When (re)evaluating, you must send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events. ... View more

Thank you for the answer, but what if i cannot or willnot install an app like this? ... View more

You can add the proxy configuration in splunk-launch.conf and also add NO_PROXY setttings as well. Refer https://answers.splunk.com/answers/555493/how-to-configure-exceptions-to-proxy-config-in-spl.html for more details. Most of the code will honor the proxy setting at OS level . ... View more

Without knowing all the details I'll try to answer: the su with the hyphen changes the user environment variables and without the hyphen it keeps the environment variables (more info here: https://superuser.com/questions/453988/whats-the-difference-between-su-with-and-without-hyphen). I believe it might be the case you didn't have permissions to read the file before and after su you kept that without the hyphen. Full su documentation is also available here: http://man7.org/linux/man-pages/man1/su.1.html. hope this helps ... View more

| makeresults count=2 | streamstats count | eval _time = if (count==2,relative_time(_time,"-8d@"), relative_time(_time,"@h")) | makecontinuous span=1min _time | appendcols [| makeresults count=10000 | eval user_id ="User".(random() % 100 + 1) | eval Platform=mvindex(split("Windows,Linux,Macosx",","),(random() % 3)) | table user_id Platform] | where isnotnull(_time) | table _time user_id Platform | rename COMMENT as "this is sample. from here, your logic" | eval Date=strftime(_time,"%Y-%m-%d") | rex field=Date "^(?<date_year>[^-]+)-(?<date_month>[^-]+)-(?<date_mday>.+)" | eval date_hour=strftime(_time,"%H") | eval date_minute=strftime(_time,"%M") | eval date_wday=strftime(_time,"%w") | stats dc(user_id) AS USERS by date_hour, date_wday, Platform | chart eval(round(avg(USERS),0)) AS "AVERAGE USERS LOGGED IN" over date_hour by Platform Hi, @gopiven date_hour is String value. so, "00" is normal. Which field is "0"? ... View more

This might be related to authorization problem or some knowledge objects permission problem. Can you run the schedule search with nobody or admin user to verify this issue. Please make sure the schedule search is created in correct app context and has access to all knowledge objects. When the schedule search is configured, please make sure it runs as owner context . Refer below documentation for more details. https://docs.splunk.com/Documentation/Splunk/8.0.1/Report/Createandeditreports ... View more

Can you take a backup of server.conf and remove sslKeysfilePassword stanza as this is deprecated and also sslPassword stanza. Restart SPLUNK, it should add the default sslPassword values again. The error you see is related to bad password on SSL Certificates . ... View more

Hi, First of all you should not be modifying the files present in $SPLUNK_HOME/etc/system/default location which is shipped by SPLUNK. If you want to modify them, please create a new .conf file in either $SPLUNK_HOME/etc/system/local or $SPLUNK_HOME/etc/apps//local directory with your setting. Please check splunkd.log and see if you are getting any error there. It appears to me you have modified some settings in web.conf file in $SPLUNK_HOME/etc/system/default which might be causing this issue. ... View more