I am trying to use the same token twice within dashboard studio. I have a dropdown which assigns a token to filter data, when I try to set the same token on drilldown of a chart. on a drop down input I set token tk_index on a table or chart I try to set the same token tk_index When I try to use the "static" option it complains that the "token name is duplicate". When I try to use the "predefined" option, it simply refuses to set it (setting to row.title.value)   any ideas ?   ... View more

Hi, struggling with this for a while. I have an epoch time value (10 digit NUMBER) that I want to use as both rising column and timestamp for the event. The first works fine , but getting it to use this for the event timestamp not. I know about the workaround of timestamp'1970-01-01 00:00:00' + ( "<my_field>" /86400 ) as eventTime, but preferably I do not ingest an extra field if it is not really necessary.   there is no config I can get to work for the timestamp. from the Java DateTimeFormatter it appears not possible, but just want to ask out here if anyone has ffound something   sources: https://docs.splunk.com/Documentation/DBX/3.13.0/DeployDBX/Troubleshooting   I have also tried using props.conf, [mysourcetype ] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true TIME_FORMAT=%s TIME_PREFIX=my_field= but it doesnt even reach this part and errors out earlier error pattern: 2023-06-20 10:27:07.521 +0200 Trace-Id=940a0c4d-8c64-44d7-a948-39fd6e9b7417 [Scheduled-Job-Executor-5] ERROR org.easybatch.core.job.BatchJob - Unable to process Record: {header=[number=1, source="SHE170U-JOURNEY_TRACKER", creationDate="Tue Jun 20 10:27:07 CEST 2023"], payload=[HikariProxyResultSet@2091779680 wrapping oracle.jdbc.driver.ForwardOnlyResultSet@4f527ef2]} java.time.format.DateTimeParseException: Text '1687249036' could not be parsed at index 0 at java.base/java.time.format.DateTimeFormatter.parseResolved0(DateTimeFormatter.java:2052) at java.base/java.time.format.DateTimeFormatter.parse(DateTimeFormatter.java:1880) at com.splunk.dbx.server.dbinput.task.processors.ExtractIndexingTimeProcessor.extractTimestampFromString(ExtractIndexingTimeProcessor.java:112) at com.splunk.dbx.server.dbinput.task.processors.ExtractIndexingTimeProcessor.extractTimestamp(ExtractIndexingTimeProcessor.java:92) at com.splunk.dbx.server.dbinput.task.processors.ExtractIndexingTimeProcessor.processRecord(ExtractIndexingTimeProcessor.java:46) at org.easybatch.core.processor.CompositeRecordProcessor.processRecord(CompositeRecordProcessor.java:61) at org.easybatch.core.job.BatchJob.processRecord(BatchJob.java:209) at org.easybatch.core.job.BatchJob.readAndProcessBatch(BatchJob.java:178) at org.easybatch.core.job.BatchJob.call(BatchJob.java:101) at com.splunk.dbx.server.api.service.conf.impl.InputServiceImpl.runTask(InputServiceImpl.java:298) at com.splunk.dbx.server.api.resource.InputResource.lambda$runInput$1(InputResource.java:162) at com.splunk.dbx.logging.MdcTaskDecorator.run(MdcTaskDecorator.java:23) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) at java.base/java.lang.Thread.run(Thread.java:833)   ... View more

when doing a partial backup (GUI)/restore (CLI), it fails with the message:     process:17394 thread:MainThread ERROR [itsi.migration] [__init__:1413] [exception] Object names must be unique for object type: kpi_threshold_template. List of duplicate names: [omitted list of duplicate objects]. Traceback (most recent call last): File "/opt/splunk/etc/apps/SA-ITOA/lib/migration/migration.py", line 200, in migration_bulk_save_to_kvstore handler.migration_save_single_object_to_kvstore(object_type=object_type, validation=validation, dupname_tag=dupname_tag, skip_local_failure=skip_local_failure) File "/opt/splunk/etc/apps/SA-ITOA/lib/migration/object_interface/itoa_migration_interface.py", line 130, in migration_save_single_object_to_kvstore skip_local_failure=skip_local_failure) File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_common.py", line 1026, in save_batch skip_local_failure=skip_local_failure) File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_object.py", line 431, in save_batch transaction_id=transaction_id, skip_local_failure=skip_local_failure) File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_object.py", line 169, in do_object_validation raise e File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_object.py", line 164, in do_object_validation self.validate_identifying_name(owner, objects, dupname_tag, transaction_id) File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_object.py", line 232, in validate_identifying_name 409 File "/opt/splunk/etc/apps/SA-ITOA/lib/ITOA/itoa_common.py", line 949, in raise_error_bad_validation raise ItoaValidationError(message, logger, self.log_prefix, status_code=status_code) ITOA.itoa_exceptions.ItoaValidationError: Object names must be unique for object type: kpi_threshold_template. List of duplicate names: [omitted list of duplicate objects].       I tried using the -e switch documented (I tried even if it only renames services/entities), https://docs.splunk.com/Documentation/ITSI/4.4.5/Configure/kvstorejson when removing the json file that has the KPI Threshold templates, the script successfully creates/updates all other objects. to be complete, this is the CLI call:      /opt/splunk/bin/splunk cmd python /opt/splunk/etc/apps/SA-ITOA/bin/kvstore_to_json.py -i -d -n -f /home/<myuser>/depot/itsi/itsi_configurations/ -u admin -p <cut> -v -e dup_202208161350       any pointers?  ... View more

We are testing federated search.  when on the provider (environment A), the fields are nicely extracted. When on the federated SH (environment B), the fields do not show up, however they are usable in SPL for filtering etc... . anyone have an idea if this is a bug/restriction. I have found here restrictions on transparent-mode FS, but we are entirely on prem (8.2.1) so we are using standard mode. I am not conflicting any of the below restrictions documented, just simple search (and data does return) index=federated:<source_index> sourcetype=<sourcetype> extract: Restrictions for standard mode federated search Standard mode federated search does not support the following: Generating commands other than search, from, or tstats. For example, federated searches cannot include the datamodel or inputlookup commands. You can find a list of generating commands in Command types, in the Search Reference. The from command can reference only datasets of the saved search and data model dataset types. Real-time search. Usage of wildcard symbols (*) to reference multiple federated indexes. Metrics indexes and related metrics-specific search commands, such as mpreview or mstats. If you must include metrics data in a federated search, consider mapping a federated index to a saved search dataset that contains metric data. See Create a federated index. in the section on transparent mode there is something about search-time field extraction which then self-references as a page.   any ideas ?     ... View more

I have a situation where entities are "associated" twice with the same service. i.e: the same service key appears twice in services._key of 1 single entity. Anyone has an idea how this could come to be ?   I know how to fix it, but I would like to understand where/when this happens. ... View more

Hi we are getting duplicates on log events Events are : - multiline - large (to very large) - also the files can grow to very large - open for long time   symptoms: - when oneshotting the file > no duplicates - duplicates may arrive on different indexers, or same indexer - duplicates may arrive in short time span or even up to an hour - we get them both from Solaris and Redhat hosts we have played with useAck, increasing filedescriptors, use of parallel mode, increasing bandwidth to try and rule out it being the flow towards the HF. From logs we do see files being read entirely up to 3 times, but this is not the case for all, so there may be several root causes. I am now thinking in the direction of writebuffers, but am not sure because I do also see smaller events being duplicated. we are using these settings for props UF: EVENT_BREAKER_ENABLE = true EVENT_BREAKER = ([\r\n]+)(?:\w+\s+\w+\s+\d{1}) HF:  TRUNCATE = 99999    # because of large messages    TIME_PREFIX = ^(?:[^\t]+?\t){4} # Format is 2021-01-18 16:03:27.118885 so 26 characters MAX_TIMESTAMP_LOOKAHEAD = 26 TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6N LINE_BREAKER = ([\r\n]+)(?:\w+\s+\w+\s+\d{1}) # newline characters can be part of the message SHOULD_LINEMERGE = false any pointers from your experience on how to further troubleshoot, or just extra pair of eyes/brain is more than appreciated.   thanks ... View more