We are monitoring a folder which has multiple ~100 files. Each file is with single line of backup status. I have indexed all the files into splunk. Each line represent below is coming from different source. 10/08/2019 23:00:00,,INC1111,SERVER1,Missed 10/08/2019 22:00:00,,INC2210,SERVER2,Missed 10/08/2019 21:00:00,10/08/2019 21:00:40,INCR2100,SERVER3,Failed 12 10/08/2019 22:00:00,,INC2200,SERVER4,Missed 10/08/2019 21:00:00,10/08/2019 21:00:40,INCR2100,SERVER5,Failed 12 10/08/2019 21:00:00,,INC2100,SERVER6,Missed 10/08/2019 21:00:00,,INC2100,SERVER7,Missed 10/08/2019 21:00:00,10/08/2019 21:00:40,INCR2100,SERVER8,Failed 12 10/08/2019 21:00:00,,INC2100,SERVER9,Missed 10/08/2019 21:00:00,,INC2100,SERVER10,Missed 10/08/2019 20:00:00,10/08/2019 20:05:02,INCR2000,SERVER11,Failed 12 Requirement is to create an individual alert for each line here. Can this be possible with any dynamic query. I can create alert in bulk but that is not the soluation we are looking for. Is there is any possiblity to create a dynamic alert for each entry above from different files. Thanks, Ramu Chittiprolu ... View more

Hi, I have a deployment server in my environment. We have an app exists "digitalApplication" targeting to index multiple files from UFs. This app targeted to all linux servers. Since this app exists in all universal forwarder now, I have received a requirement to stop monitoring a File (Access.log) in one of the UF server. This states that "digitalApplication" exists in UF /etc/apps directory with Access.log. Please note that app "digitalApplication" contains many other files from deployment server. Now the question is, how to disable monitoring for Access.log in one single UF. Thanks, Ramu Chittiprolu ... View more

Dears, My Splunk Indexer is in CDT time zone and my forwarder logs are in UTC time zone and there is time difference of 5hrs. When I do the search in my splunk search head, data is getting indexed with 5 hour difference with the current time of splunk indexer. Below are the forwarder logs: 2019-06-11 12:50:42 10.100.4.65 GET /Test/GetStoreItemInv/1111/000000/username/ - 9988 - 10.111.195.0 okhttp/2.6.0 - 200 0 0 531 2019-06-11 12:50:42 10.100.4.65 GET /Test/GetStoreItemInv/0910/2882183/username/ - 9988 - 10.111.195.0 okhttp/2.6.0 - 200 0 0 515 2019-06-11 12:50:42 10.100.4.65 GET /Test/GetStoreItemInv/2237/0544067/username/ - 9988 - 10.111.195.0 okhttp/2.6.0 - 200 0 0 578 2019-06-11 12:50:42 10.100.4.65 GET /ITest/GetStoreItemInv/2086/8513336/username/ - 9988 - 10.111.195.0 okhttp/2.6.0 - 200 0 0 671 I had updated the below stanza in on my forwarder /etc/system/loca/props.conf file but still nothing seems to be worked. [ItmInqWebServiceWeb] TZ = America/Chicago For time being, every time I search I'm adding "latest=+5h earliest=+45m" with my search. Do I also need to update the above stanza in indexer server props.conf as well? Thanks, Ramu Chittiprolu ... View more

Hi, I have around 1k number of hosts setup in AWS containers where I don't have access to any forwarders. All my forwarders points out my splunk on-premise environment. When I'm trying to look for the metrics log for all my forwarders, I coudn't find any of them and able to see only splunkd.log in my splunk. I'm pretty sure only splunkd.log are ingested to splunk. But is this possible, can I restrict splunk internal logs like metrics.logs not to forward to indexer server. If yes, where is the configuration needs to be set. Kindly help. Thanks, Ramu Chittiprolu ... View more

Dears, I'm unable to see my login button in my splunk home page: localhost:8000. Also, unable to see logout button as well. Seeing the below error in messages. Missing or malformed messages.conf stanza for LM_LICENSE:WARNINGS_GENERATED Can someone update what is happening here. Thanks, Ramu Chittiprolu ... View more

Dears, I have requested for the developer license extension last week but haven't seen any reply from Splunk. Requested for the license again today. Sent an email to devinfo@splunk.com. Any chances of free license extension for my app implementation. Thanks, Ramu Chittiprolu ... View more

Hi, We have a couple of servers from HP NonStop OSS environment which is not 100% Unix. Instead, OSS is “Unix-like” where most Unix commands will work in OSS. I have got a requirement to forward the HP NonStop OSS application logs to splunk. I have gone through the documentation but couldn't find any details. Can this be achieved? Thanks, Ramu Chittiprolu ... View more

Dears, I have two search heads in my environment and have two different HTTP URLs for my end users for splunk login. However, I would like to point my two different search head URLs to the common URL at netscaler end. Something like this https://splunkprd-web.com. I want my front-end Splunk URL to be hitting on SSL. This can be done on netscaler end by pointing the common URL to my two search head servers. At the same time, do i have to keep my individual search heads running on SSL by going to server settings. I'm even ok with the approach of my individual search head splunk URLs running on http. But my front end URL should be on HTTPS. Can someone confirm, if this is valid approach. Thanks, Ramu Chittiprolu ... View more

I have around 700 forwarders send the data to splunk and no index will keep data longer than 90 days. My indexed data seems to be fine for last one week. However, If i go for search before a week, number of returned data is significantly very low. I have been observing this issue from past one month. Data and number of returned hosts for a search is very very low before a week. Can anyone suggests what is happening and why splunk is behaving like this. Thanks, Ramu Chittiprolu ... View more

Hi, I have installed HipChat Room Notification app in my splunk and configured a search alert to a HipChat room. However, my alert is not reaching destination. It throws me the below error in my internal logs. Raised a case with Splunk, seems like they don't support this. Any help. 04-23-2018 17:10:02.344 +0000 WARN sendmodalert - action=hipchat - Alert action script returned error code=2 04-23-2018 17:10:02.344 +0000 INFO sendmodalert - action=hipchat - Alert action script completed in duration=68 ms with exit code=2 04-23-2018 17:10:02.341 +0000 FATAL sendmodalert - action=hipchat STDERR - Failed trying to send room notification 04-23-2018 17:10:02.341 +0000 ERROR sendmodalert - action=hipchat STDERR - } 04-23-2018 17:10:02.341 +0000 ERROR sendmodalert - action=hipchat STDERR - } 04-23-2018 17:10:02.341 +0000 ERROR sendmodalert - action=hipchat STDERR - "type": "Unauthorized" 04-23-2018 17:10:02.341 +0000 ERROR sendmodalert - action=hipchat STDERR - "message": "Invalid OAuth session", 04-23-2018 17:10:02.341 +0000 ERROR sendmodalert - action=hipchat STDERR - "code": 401, 04-23-2018 17:10:02.341 +0000 ERROR sendmodalert - action=hipchat STDERR - "error": { 04-23-2018 17:10:02.341 +0000 ERROR sendmodalert - action=hipchat STDERR - Server response: { 04-23-2018 17:10:02.341 +0000 ERROR sendmodalert - action=hipchat STDERR - Error sending message: HTTP Error 401: Unauthorized (['HTTPErrorsuper_init', 'class', 'delattr', 'dict', 'doc', 'format', 'getattribute', 'getitem', 'getslice', 'hash', 'init', 'iter', 'module', 'new', 'reduce', 'reduce_ex', 'repr', 'setattr', 'setstate', 'sizeof', 'str', 'subclasshook', 'unicode', 'weakref_', 'args', 'close', 'code', 'errno', 'filename', 'fileno', 'fp', 'getcode', 'geturl', 'hdrs', 'headers', 'info', 'message', 'msg', 'next', 'read', 'readline', 'readlines', 'reason', 'strerror', 'url']) 04-23-2018 17:10:02.307 +0000 INFO sendmodalert - action=hipchat STDERR - Sending message to hipchat room=1_splunk_alert_testing@conf.btf.hipchat.com with format=text Thanks, Ramu Chittiprolu ... View more