Upgrading to VERSION=8.0.4.1 I'm getting this error running as ROOT!! Migrating to: VERSION=8.0.4.1 BUILD=ab7a85abaa98 PRODUCT=splunk PLATFORM=Linux-x86_64 Copying '/opt/splunk/etc/myinstall/splunkd.xml' to '/opt/splunk/etc/myinstall/splunkd.xml-migrate.bak'. Checking saved search compatibility... Handling deprecated files... Checking script configuration... An unforeseen error occurred: Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied: '/opt/splunk/etc/system/local/inputs.conf.tmp' Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1353, in <module> sys.exit(main(sys.argv)) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1206, in main parseAndRun(argsList) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 1061, in parseAndRun retVal = cList.getCmd(command, subCmd).call(argList, fromCLI = True) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 293, in call return self.func(args, fromCLI) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/control_api.py", line 30, in wrapperFunc return func(dictCopy, fromCLI) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/_internal.py", line 189, in firstTimeRun migration.autoMigrate(args[ARG_LOGFILE], isDryRun) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/migration.py", line 3094, in autoMigrate migInputs_3_3_0(migInputsConf, dryRun) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/migration.py", line 1682, in migInputs_3_3_0 comm.sed(policySearch, policyReplace, path, inPlace = True) File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli_common.py", line 1232, in sed outFile = open(tmpPath, 'w') PermissionError: [Errno 13] Permission denied: '/opt/splunk/etc/system/local/inputs.conf.tmp' Please file a case online at http://www.splunk.com/page/submit_issue Error running pre-start tasks Root is how I always run the upgrade process yet never have run into this issue before! ... View more

I have a specific source type and hosts that I want to export the raw logs for the past 24h is there a way to do that via the ui as I do not have admin access. ... View more

Hopufully a quick one but I'm looking to search and extract anything between two these fields TEXT anyone know how? ... View more

I'm looking to find everything that has the string "Task Failed". I want splunk to get the task_id and then use all those task_id's for another search which looks for different strings but only ones that also have the ID's it found in the initial search. ... View more

I have a search using transaction and the startswith/endswith but I don't know how to call the Task_time field in the starts with of my transaction "Encode Time" and the Task_time field in the ends with "Transfer Time"? ... View more

I'm new to splunk, here's my issue. I have a log file which contains the extracted fields below: task_id task_duration content_owner task_type I'm looking to find the task_duration for two search strings "string ABC" OR "string 123" so those two lines which would return would have task_id, task_duration, and task_type. I need to use the task_id to find the content_owner as its elsewhere in the log... In the end what I want to see is: task_id: #### content_owner: XYZ task_type: XYZ task_duration: #### task_type: ZYX task_duration: #### task_id: #### etc ... View more