Hi all, i have configured and started the Splunk Add-on for VMware v 4.0.5 on two heavy forwarders. Unfortunately will the port 8008 not be available after restarting the Splunk instance. I get everytime following entries in splunkd.log 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" Traceback (most recent c all last): 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" File "/opt/splunk/etc/ apps/SA-Hydra/bin/bootstrap_hydra_gateway.py", line 26, in <module> 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" port, service_log_le vel, access_log_level = get_gateway_config(session_key) 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" File "/opt/splunk/etc/ apps/SA-Hydra/bin/bootstrap_hydra_gateway.py", line 16, in get_gateway_config 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" stanza = HydraGatewa yStanza.from_name("gateway", "SA-Hydra", session_key=session_key) 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" File "/opt/splunk/etc/ apps/SA-Hydra/bin/hydra/models.py", line 610, in from_name 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" host_path=host_path) 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" File "/opt/splunk/lib/python3.7/site-packages/splunk/models/base.py", line 552, in get 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" entity = self._get_entity(id, host_path=host_path) 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" File "/opt/splunk/etc/apps/SA-Hydra/bin/hydra/models.py", line 339, in _get_entity 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" splunk.entity.getEntity(self.model.resource, None, sessionKey=self.sessionKey, uri=mid, hostPath=host_path)) 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" File "/opt/splunk/lib/python3.7/site-packages/splunk/entity.py", line 277, in getEntity 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" File "/opt/splunk/lib/python3.7/site-packages/splunk/rest/__init__.py", line 553, in simpleRequest 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" raise splunk.AuthenticationFailed 06-16-2023 16:36:51.103 +0200 ERROR ExecProcessor [23751 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/SA-Hydra/bin/bootstrap_hydra_gateway.py" splunk.AuthenticationFailed: [HTTP 401] Client is not authenticated Does someone any idea to solve this issue with Authentication failed? Kind regards Kathrin   ... View more

Hi all, I get following error Message: JZ00L: Login failed. Examine the SQLWarnings chained to this exception for the reason(s). I tried it with DBConnect version 3.3.1 and 3.1.4. I want connect to following version: Adaptive Server Enterprise/16.0 SP03 PL05 HF1/EBF 28622 SMP/P/x86_64/SLES 11.1/ase160sp03pl05x/3463/64-bit/FBO/Thu Sep 13 09:24:26 2018 I tried it with different JDBC drivers it is still not working. Can i find any additional error messages from Splunk or are there any other debug possibilities? kind regards Kathrin ... View more

Hi, we have build a new app internally. We use different CSV-Files to save relevant data. Is there any possibility to ignore this files during packaging the app on development system or is there a flag we can set on production system that these csv files are not overwritten during update? Because the csv files have different content on development and production system. Thanks for your support Kathrin ... View more

We want to change the order of these apps in the dropdown menu. In my mind it seems that this order depends on the sequence of installing the apps. Any new app installed is at the bottom of the list. Is there an opportunity to configure it? ... View more

I try to index sybase logs which are located in /sybase/SID/ASE-1(5|6)_0/install/SID.log (SID is variable System-ID) In Whitelist i only want to monitor files with FL2.log or ACE.log normal regex should be ^[A-Z0-9]{3}.log$ I will use following monitor-stanza on Universal Forwarder: [monitor:///sybase/*/ASE-1*_0/install/] whitelist=^[A-Z0-9]{3}\.log$ sourcetype=source_sybase index=ios_db _TCP_ROUTING=splunk_main disabled=false But then nothing is indexed. If I use the same stanza without the ^(anchor), then too many files like SID.log or SID_JSAGENT.log are indexed. [monitor:///sybase/*/ASE-1*_0/install/] whitelist=[A-Z0-9]{3}\.log$ sourcetype=source_sybase index=ios_db _TCP_ROUTING=splunk_main disabled=false Does someone have an idea why this is not working or is this a bug in splunk? ... View more