hi Team, Any updated? below are the more logs. (IP's in the below logs are intentionally masked)   06-11-2022 10:18:11.819 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::/opt/splunkforwarder/var/log/splunk/health.log|host::XXXXXXXXXXX|splunkd|727, streamId=0, offset=0 on host=xxxxxxxx:9997 06-11-2022 10:18:11.819 +0000 WARN TcpOutputProc - Possible duplication of events with channel=source::/var/log/cron|host::xxxxxxxxxx|cron|637, streamId=0, offset=0 on host=XXXXXXXXXXXX:9997 06-11-2022 10:18:11.827 +0000 ERROR TcpOutputQ - Unexpected event id=2 06-11-2022 10:18:11.829 +0000 INFO TcpOutputProc - Connected to idx=xxxxxxxxxx:9997, pset=0, reuse=0. using ACK. 06-11-2022 10:18:11.829 +0000 ERROR TcpOutputQ - Unexpected event id=3 06-11-2022 10:18:11.829 +0000 ERROR TcpOutputQ - Unexpected event id=4 ... View more

Hi MuS, I think, found the issue. in myLDAP2.py, pages_size has been hardcoded to 5, when I have increased to 50 then iäm getting 50 results. So Im checking for the option to change it to unlimited. searchParameters = { 'search_base': basedn, 'search_scope': scope, 'search_filter': ldap_filter, 'attributes': [''], 'paged_size': 5 } my_filter = '(&' + ldap_filter + ')' l.search(search_base=basedn, search_filter=my_filter, attributes=[""], paged_size=5) With Regards, Krishna ... View more

Hi MuS, Still unfortunately im getting same result of 5 rows. I have tested this in other environment. Enabling debug didnot help too. can you please help in fixing this. I think this is some issue with version 4.0.0 or am i missing something? With Regards, Krishna ... View more

Thanks MuS for the response. I have enabled debug, but i have not seen any errors as iäm getting result of 5 rows. Also I have observed that it is not taking the options (Eg L:DAP_filter)) which I have provided in the search or from the inputs.conf. When I have changed the default filter directly in the myLDAP2.py then it has taken the default value in the script. Not sure iäm missing something or some issue with the python script. With Regards, Krishna ... View more

Hi MuS, can you please help to download the 3.x version of this add-on to test it in my environment. I feel we have some issue in the latest version's myLDAP2.py script. With Regards, Krishna ... View more

@raghu_vedic I have updated the Splunk_TA_snow/local/service_now.conf file manually, which has helped me to fix the issue. ... View more

Hi Jcoates, I'm facing the same issue in my servicenow instance. getting this error in both my splunk windows and Linux instance. Can you please help me in to resolve this issue. With Regards, Krishna R ... View more

Thanks Miller for your response. Also, We have two search heads and two indexers each in search head & Index clustering with two sites. We have totally 4 search heads and 4 indexers, 1 masternode, 1 deployer and 1 deployment server as per our design. We are planning to provision our servers in AWS cloud so we would like to know the Server configuration with which we have to go with for the below requirement. Concurrent users: 25 Saved Searched: 15 Licensing model : 100GB/day Site replication factor: origin:2, site1:1, total:3 ... View more

Hi rmearkle, I have similar kind of requirement. How can we call this entire code in a function? How can use this code to restrict few inputs buttons as invisible? -Krishna Rajapantula ... View more

Hi, Try to check Forwarder health app, you can get an idea on search queries you can use which you can use for any other generic purpose. -Krishna Rajapantula ... View more

Hi Experts, Any solution available for the above query? -Krishna Rajapantula ... View more

Hi jclemons, I believe you can use round fucntion. round(fieldname,2) here 2 is for 2 decimal points. In your case round(fieldname,0) -Krishna Rajapantula ... View more

Updated the code below in a screenshot. -Krishna Rajapantula ... View more

Hi, We can clone the view in settings-userinterface-views under your applications and you can add that view name in navigation. settings-userinterface-navigations under your application I have tested this in my server and it is working -Krishna Rajapantula ... View more

Hi, I have created new index with lowercase with name wmtmf1 and updated the inputs.conf, still it is same. can you please tell me the issues with props.conf Above result is the output of ./splunk btool list props > props_list.txt -Krishna Rajapantula. ... View more

Hi, Yes, event i have noticed that and changed the index name in inputs.conf with lower case, still no luck. can you please see the above props.conf , is there any issue with that [TMF_XML] stanza? -Krishna Rajapantula ... View more

Hi, I have below for [TMF_XML] stanza in props.conf in indexer server [TMF_XML] ANNOTATE_PUNCT = True AUTO_KV_JSON = true BREAK_ONLY_BEFORE = \ BREAK_ONLY_BEFORE_DATE = false CHARSET = AUTO DATETIME_CONFIG = \etc\datetime.xml HEADER_MODE = KV_MODE = xml LEARN_SOURCETYPE = true LINE_BREAKER_LOOKBEHIND = 100 MAX_DAYS_AGO = 2000 MAX_DAYS_HENCE = 2 MAX_DIFF_SECS_AGO = 3600 MAX_DIFF_SECS_HENCE = 604800 MAX_EVENTS = 256 MAX_TIMESTAMP_LOOKAHEAD = 128 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = NO_BINARY_CHECK = true REPORT-xmlext = xml-extr SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard SHOULD_LINEMERGE = True TRANSFORMS = TRUNCATE = 10000 category = Custom detect_trailing_nulls = auto disabled = false maxDist = 100 priority = pulldown_type = true sourcetype = -Krishna Rajapantula ... View more

Hi alacercogitatus, Thanks for your response. Yes, I have already tried by defining record= undefined and {} in the .done function for the service.request, still no luck. I believe we have to empty the below in "record", as it is taking the input from browser. "CustID": form_id, "CustName": form_name, "CustStreet": form_street, "CustCity": form_city, "CustState": form_state, "CustZip": form_zip -Krishna Rajapantula. ... View more

Hi tskinnerivsec, Thanks for your responses. I have tried all the steps mentioned, still no luck. surprisingly if i'm not mentioning then it is getting indexed in default index So I believe it is only problem with the indexes other than default "main" index. I have created those index manually before pushing this data , not sure where is the issue? -Krishna Rajapantula. ... View more