About R15

R15 · ‎03-26-2024

Neither are working for me. Their search gives an unwieldy table with 100+ columns, yours has only blanks for avg and max. Splunk 9.1.2

R15 · ‎02-22-2024

We upgraded splunk then the app to 1.4.6, but kept getting the same errors. The solution was rather silly. It couldn't run python3.exe because the python installer named it python312.exe... renamed and the app started working.

R15 · ‎11-29-2023

No, I don't believe so.

R15 · ‎11-28-2023

What version of splunk are you running? We're still on 8, but upgrading to 9 soon™.

R15 · ‎11-15-2023

@LukeMurphey I'm trying to run the File/Directory Information Input app (v1.4.5) on a universal forwarder. It's a windows server and I've installed the latest version of python 3 (and set the app to use 3). I keep getting the same 3 errors in splunkd (copied from another post as my system is isolated): "09-18-2019 10:47:10.099 +0200 ERROR ModularInputs - Introspecting scheme=file_meta_data: Unable to run "python "C:\Program Files\SplunkUniversalForwarder\etc\apps\file_meta_data\bin\file_meta_data.py" --scheme": child failed to start: The system cannot find the file specified. 09-18-2019 10:47:10.356 +0200 WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts 09-18-2019 10:47:10.356 +0200 ERROR ModularInputs - Unable to initialize modular input "file_meta_data" defined in the app "file_meta_data": Introspecting scheme=file_meta_data: Unable to run "python "C:\Program Files\SplunkUniversalForwarder\etc\apps\file_meta_data\bin\file_meta_data.py" --scheme": child failed to start: The system cannot find the file specified.." (Except it says Python3.exe instead of python). Other posts with these errors did not have python installed, or one said their path environment variable was incorrect but didn't elaborate. My path is set with the 2 default values from the installer if that matters.

R15 · ‎11-01-2023

@isoutamo @inventsekar We'll be upgrading soon but until then I'm stuck.

R15 · ‎10-31-2023

@inventsekar apparently avg is not an eval function in my version of splunk. It's available with other things like chart and stats, but not eval. Something like this works however: ... | chart eval(avg(bytes) ...

R15 · ‎10-31-2023

There is no other portion, running the same search as in your screenshot I get the error.

R15 · ‎10-30-2023

I was building a new search and started getting this error with various functions. I simplified my search down to something straight out of the documentation to make sure I wasn't missing something silly, but still get the error even with this: index=* | eval c=avg(1, 2, 3) What's going on?

R15 · ‎05-25-2023

@yeahnah I have confirmed the forwarder and indexer are both on 8.0.6. We intend to upgrade but I'd be lucky if it's by the end of the year. With no sourcetype or with the default csv sourcetype the events do not have proper timestamps. So I know my sourcetype is definitely being applied, and it works, it's just throwing out these junk events as well for some reason. I replaced it with the code from @isoutamo and got the same result. I will turn to support for further troubleshooting. Thank you both for your time!

R15 · ‎05-24-2023

I did some testing before implementing by starting to add a sample directly to an indexer, and the events preview looked good. There were no extra events. I will push your sourcetype code and report back (I'll just replace MAX_DAYS_AGO=9999 with TIMESTAMP_FIELDS=TimeCreated). Our forwarders are running 8.0.6

R15 · ‎05-23-2023

I've checked and that box was already ticked. I ran that search and there are events when I made changes yesterday and last week. Are we at a dead end?

R15 · ‎05-22-2023

@yeahnah I've added that line and removed HEADER_FIELD_LINE_NUMBER but to no effect. You mentioned restarting the forwarder which I haven't been doing as I don't have permissions. I've been pushing these changes from a deployment server (which I have full access/control).

R15 · ‎05-17-2023

I do have access and have looked through a few dozen of them. They all appear normal/identical for the first two lines. I can't copy and paste from that environment so I only typed the first few fields of line 2: #TYPE System.Diagnostics.Eventing.Reader.EventLogRecord "Message","Id","Version","Qualifiers","Level","Task" They're all Windows event logs with the same fields. To reiterate, before I was getting all events correctly plus an additional event containing only line 2. After adding HEADER_FIELD_LINE_NUMBER = 2, I'm still getting that additional event plus another containing only line 1.

R15 · ‎05-17-2023

props.conf: [sample] SHOULD_LINEMERGE = false pulldown_type = true HEADER_FIELD_LINE_NUMBER = 2 INDEXED_EXTRACTIONS = csv TIMESTAMP_FIELDS = TimeCreated KV_MODE = none category = Structure disabled = false inputs.conf: [monitor://filepath] disabled = 0 crcSalt = <SOURCE> index = index2 sourcetype = sample I've redacted the filepath and changed some names. I'm not currently using any transforms. This is monitoring ~250 csv's that get replaced once a day. It works fine except for the extra events. Thank you for your assistance.

R15 · ‎05-16-2023

Hi, I found similar questions but the usual solution of using HEADER_FIELD_LINE_NUMBER did not work. My custom csv sourcetype is working fine, except I'm getting an extra event with the column names. Splunk knows they're column names, it's still treating them as fields so the event has Col1=Col1, Col2=Col2 etc. The csv's all start the same, there's an identical line 1 then and identical line 2 which is the column names. After adding HEADER_FIELD_LINE_NUMBER =2 (in props.conf on the forwarder), I'm still getting events with the column names, but now I'm ALSO getting events with just the first line as well. Am I missing something? Thanks

R15 · ‎01-04-2023

@richgalloway I'm new here and still trying to wrap my around this as I prepare to help upgrade and then later expand our setup. It's a very small deployment (for now), 2 indexers which are also search heads with replication between indexers. Would this mean ALL of our saved searches violate the above?

R15 · ‎01-03-2023

Hi, We're preparing to upgrade SE from 8 to 9 and have a question about this requirement: For distributed deployments of any kind, confirm that all machines in the indexing tier satisfy the following conditions: ... ... They do not run their own saved searches If our indexers are also search heads, would that violate this?

R15 · ‎12-14-2022

Hi, We're preparing to upgrade SE from 8 to 9 and have a question about this requirement: For distributed deployments of any kind, confirm that all machines in the indexing tier satisfy the following conditions: ... ... They do not run their own saved searches If our indexers are also search heads, would that violate this?

Posts	21
Solutions	2
Karma Given	99
Karma Received	0
Member Since	‎12-14-2022

Online Status	Offline
Date Last Visited	Thursday

File/Directory Information Input app help

The avg function is unsupported or undefined

How to get events for .csv headers?

Splunk Upgrade Requirement Clarification

Upgrade Requirement Clarification

Re: Search lag error

Re: File/Directory Information Input app help

Re: How to get events for .csv headers?

Re: How to get events for .csv headers?

File/Directory Information Input app help

Re: The avg function is unsupported or undefined

Re: The avg function is unsupported or undefined

Re: The avg function is unsupported or undefined

The avg function is unsupported or undefined

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

How to get events for .csv headers?

Re: Splunk Upgrade Requirement Clarification

Splunk Upgrade Requirement Clarification

Upgrade Requirement Clarification