Hello All, I have 3 indexer in cluster and data is being stored in the NAS server. and for one server data is stored in cold logs on a mounted storage. I have copied the data from NAS to 2 server , the one with mounted point is giving me a duplicate error and I am not able to see data copied in the /opt/splunk/var/lib/splunk/accessdb/thaweddb/ is marked as diabled due to conflict. I have tried multiple commands to rebuild the Splunk db in all the indexers. and I am getting error as attached screenshots @ivanreis @lmyrefelt @kmorris_splunk @Masa @jkat54 @493669 @mayurr98  ... View more

Hello Friends  I am facing issues that may be caused by input.conf but I am not able to get bottom of the problem when I search index=network "*f5*" in which 2 types of sourcetype are coming  f5:bigip:syslog f5:bigip:asm:syslog and certain event count against each sourcetype when search index=network and sourcetype="*f5*",  then under index=network f5:bigip:ltm:tcl:error f5:bigip:syslog and certain event count against each sourcetype but when I put index=network sourcetype="f5:bigip:asm:syslog" no events is found I am collecting the data from f5 on a server (HF) and collecting the data on indexer from HF. Add on are installed but I am not sure whether its configured. Input.conf contains entry for f5:bigip:syslog can someone please help Regards Gaurav @prakash007  @renjith_nair  @jbsplunk  ... View more

Hello All I facing the below error while updating my apps like ES content update Splunk machine learning toolkit or any other app like ES content update. I have gone through the various articles but I am unable to find an answer suitable to updating the apps, can someone please suggest a solution. 2021-06-14 10:53:11,290 ERROR [66c6c494237f7714a7eb50] init.. :361 - Mako failed to render: Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/__init__.py", line 357, in render_template return templateInstance.render(**template_args) File "/opt/splunk/lib/python3.7/site-packages/mako/template.py", line 476, in render return runtime. _render(self, self.callable_, args, data) File "/opt/splunk/lib/python3.7/site-packages/mako/runtime.py", line 883, in _render **_kwargs_for_callable(callable_, data) File "/opt/splunk/lib/python3.7/site-packages/mako/runtime.py", line 920, in _render_context exec_template(inherit, lclcontext, args=args, kwargs=kwargs) File "/opt/splunk/lib/python3.7/site-packages/mako/runtime.py", line 947, in _exec_template callable_(context, *args, **kwargs) File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 15, in render_body <%self:render/> File "/opt/ splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 21, in render_render <%self:pagedoc/> File "/opt/splunk/share/splunk/search_mrsparkle/templates/layout/base.html", line 95, in render_pagedoc <%next: body/> File "/opt/splunk/share/ splunk/search_mrsparkle/templates/layout/view.html", line 25, in render_body ${next.body} File "/opt/ splunk/share/splunk/search_mrsparkle/templates/layout/admin.html", line 26, in render_body ${next.body()} File "/opt/splunk/share/ splunk/ search_mrsparkle/templates/admin/appinstall/upgrade-available.html", line 14, in render_body escapedAppName = su.escape(appname) File "/opt/splunk/lib/python2.7/xml/sax/saxutils.py", line 27, in escape data = data.replace("&", "&amp;") AttributeError: 'None Type' object has no attribute 'replace' Any help will be appreciated Regards Gaurav Chauhan @MuS @somesoni2 @aljohnson_splun @sideview @hexx  ... View more