Hi all,   For our environment we want to ingest VMWare data for ITSI. The documentation tells us we need an OVA, so we installed one. However, this took a long time. And now I see we need a seperate Scheduler since the searchhead is actually on Windows, which I did not notice in time is apparently not possible to combine with a Scheduler. It is also a bit vague to me how the connection works. With the scheduler you link a vCenter, so the scheduler needs a connection to the vCenter as well? And this data is then used on the DCN to also connect with the vCenter? My main question is: Is it possible to skip the scheduler and edit a conf file on the DCN itself to start ingesting VMWare and vCenter data right away? We have a limited time schedule since this is just a test environment and the ITSI license doesn't last forever.  Regards, Tim ... View more

Hi everyone,   This might be a weird question, but I have been testing out ITSI and recently I tried editing some thresholds I set for KPIs I created myself. Regardless of the service or KPI I try to edit, the Thresholding drop down does NOT open. I can open the "Search and Calculate" drop down no problem, as well as the "Anomaly Detection" drop down (and get a java warning to boot).  I feel like this might be an issue with the system, but why specifically Thresholding? What happens is the arrow will point down like it was opened, but nothing will actually happen. I tried different browsers too. If anyone can help me it would be very much appreciated. ... View more

As the title suggests, Im getting the following error when trying to execute a custom alert action script. The script is quite simple. Its a shell script that basically looks like this: #!/bin/bash if [[ "$1" == "--execute" ]]; then https_proxy=proxyname:port curl --header "content-type: text/soap+xml; charset=UTF-8" --data @alertBody.xml https://url/api fi If I execute this through the command line using: sh alert.sh --execute, it works perfectly. But I get the above error instead. It references the script in the following way: ERROR ScriptRunner - Couldn't start child process. script="/opt/splunk/etc/apps/alert_app/bin/alert.sh --execute" I am not trying to give arguments to the script. It's a simple script that posts to an API with predetermined text that's always the same in the xml body. My alert actions looks as follows: [alert] is_custom=1 label=alertTest icon_path=logevent.png disabled=0 Adding some fields didn't help, but maybe someone can help me find which ones are mandatory? I copied the png from another alerting app and placed it in the same folder.   ... View more