I would suggest a manual edit or deployment of *NIX App. Using deployment server. ... View more

If an admin actually started Splunk as root at least once, I would suggest to check permissions on directory $SPLUNK_HOME ( with recursion ), prior to attempting to start Splunk as your user of the limited domain ( in your case, splunk ) ... ... View more

Perfect, thanks! ... View more

Yes, because it is a pull-type of connection. ... View more

MAX_EVENTS = <integer> Specifies the maximum number of input lines that Splunk software adds to any event. The software breaks the event after it reads the specified number of lines. 256 lines REF. https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Configureeventlinebreaking ... View more

msivill, I have tried to configure splunk-logging-driver-for-docker as you suggested. It worked like a charm. But, it stops working as soon as OpenShift gets added to the mix. Reading OpenShift source code ... got complex and "hairy in a hurry." If anyone has any real-world implementations of the Splulnk App suggested by outcoldman, I would love to hear your thoughts. PM is ok. Y. ... View more

The new Service object seems to run as many searches as your quota allows. I have not seen a need to establish new connection for each thread. What version SDK / Splunk are you using ? Post your specific error, if got one. ... View more