Hi team, I had upgraded from 9.0.5 version to 9.1.2 and upgradation successfully completed, but splunk web page can't reach this page  window displayed. and verified the bin  directory E:\splunk\bin>openssl s_client -connect simdoowwww:443 WARNING: can't open config file: ::::::/openssl.cnf connect: No such file or directory connect:errno=0     web.conf   [settings] enableSplunkWebSSL = 1 privKeyPath =a $SPLUNK_HOME\etc\auth\custom\myServerPrivateKey.key serverCert = $SPLUNK_HOME\etc\auth\custom\gddjkowww.ap.kinely.com.pem httpport = 443     The above configuration  in back end system, but page can't read this page displayed please help me on that.     ... View more

Hi Team,    Currently we are installed the Splunk DB app in Heavy Forwarder, How to Connect this app from Heavy Forwarder to Splunk Cloud Search Head+Indexer server ? ... View more

Hi team , 1 .How to monitor the Splunk DB logs, already installed and configured. 2. How to 2 queries of splunk db ingest into single index?   ... View more

Hi Team, My requirement is Universal Forwarder installation on Kubernetes On-premises system.   Please send me guide on installation on Kubernetes.        ... View more

Hi,  UF etc/apps/remo/local  placed the inputs,outputs,props and tranforms configuration files  and search the data in indexer+SearchHead  servers , Events  are received Successfully. [monitor://E:\KS Application GBR (GR)\sbxLogs\] index = ks_dev sourcetype = ks_logs crcSalt = <SOURCE>   [tcpout:bprserver] server = 1.2.3.4:9997 useACK = true [ks_logs] TRANSFORMS--null = EXCLUDE_INFO_WARN_events [EXCLUDE_INFO_WARN_events] REGEX = ^[\d|-]*\s[\d|:|,]*\s(INFO|WARN).*$ DEST_KEY = queue FORMAT = nullQueue   Same configuration updated in the deployment server etc\deploymentapps\ksapp\local [monitor://E:\KS Application GBR (GR)\sbxLogs\] index = ks_dev sourcetype = ks_logs crcSalt = <SOURCE> [tcpout:bprserver] server = 1.2 3.4:9997 useACK = true [ks_logs] TRANSFORMS--null = EXCLUDE_INFO_WARN_events [EXCLUDE_INFO_WARN_events] REGEX = ^[\d|-]*\s[\d|:|,]*\s(INFO|WARN).*$ DEST_KEY = queue FORMAT = nullQueue   Events are receiving  the SH+indexer server Note: in my account there is no HeavyForwarder instance. please help how to do configuration in deployment server.                 ... View more

Hi Team i had provided user roles  has Read only access. but user having edit and delete the reports, how to restrict  the user access as Read only access for the reports, The below had provided  configuration and Roles capablities  had given below.   Please help me  how to restrict the user  access.  User not able to delete option  and not able edit Splunk Queries.     [savedsearches/krack_delete] access = read : [ * ], write : [ power ] export = system owner = vijreddy@xxxxxxxxxxxxx.com version = 9.0.5.1 modtime = 1704823240.999623300     ... View more

Hi Team,   In role we are providing the user as read only access, and set up the capabilities, Inheritress , resources, and restrictions.  But that user able to delete the query and delete the report also, how do we hide delete option in the report?   Please guide the process.         ... View more

Hi Team, In my requirement, if any splunk servers are got failed, need to be generated Services now incidents need to be created automatically...   How do we write the query and how do we configure Service now incidents, please help me      ... View more

Hi Team,   In my project need to be implement High Availability servers in below Servers are using. Z1-->L4 -->SearchHead+Indexer single instanceonly(Dev)               SearchHead+Indexer single instanceonly(QA) DeploymentServer(QA) HearvyForwarder(Prod) DeploymentServe(Prod) -------------------------------------------------- App related below server:   Z2 --> HearvyForwarder(Prod,Dev,QA) individual Servers Z3--> HearvyForwarder(Prod,Dev,QA) individual Servers   The above App related servers are connected Deployment server and SearchHead+Indexer Note : my project there is no Cluster master   Please help how do we implement the High Availability implementation, please help the guide the above servers.     ... View more

Hi All, The below 10 Error Records have, Last 3 Error records need not ingested, the above 7 error records data only be ingested.How do we write the Regular Expression ,please guide me.     2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - PCI ERROR: No package class found with name: PRD-QDB35801A 2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - PCI ERROR: (INVALID_DATA) Invalid value [V5100000003P211] specified for parameter [package_class__c] : Object record ID does not resolve to a valid active [package_class__c] 2023-11-06 15:30:48,941 ERROR https-jsse-nio-8443-exec-9 com.veeva.brp.batchrecordprint.BatchRecordPrintController - PRINT ERROR: Print failure response 2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - Unknown error: {errorType=GENERAL, responseStatus=EXCEPTION, responseMessage=502 Bad Gateway} 2023-11-06 15:30:48,941 ERROR https-jsse-nio-8443-exec-2 com.veeva.brp.batchrecordprint.BatchRecordPrintController - (API_LIMIT_EXCEEDED) You have exceeded the maximum number of authentication API calls allowed in a [1] minute period. 2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - PCI ERROR: No package class found with name: PR01-PU3227V1MSPS 0001 2023-11-08 06:19:49,539 ERROR https-jsse-nio-8443-exec-1 com.veeva.brp.batchrecordprint.BatchRecordPrintController - DOCLIFECYCLE ERROR: Error initiating lifecycle action for document: 5742459, Version: 0.1 2023-10-25 10:56:46,710 ERROR pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks - Header Field Name: bom_uom_1_c, value:E3HR5teHlfOQjzUJ74jTdKh1Tu0yajHqT/H98klZOyU= 2023-10-25 10:56:46,711 ERROR pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks - BOM Field Name: BOM_Added_1, value is out of Bounds using beginIndex:770, endIndex:771 from line: 2023-10-25 10:56:46,711 ERROR pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks ... View more

  Hi All,   2023-10-25 10:56:46,709 WARN pool-1-thread-1 com.veeva.bpr.batchrecordprint.scheduledTasks - BOM Field Name: BOM_PPMDS_1, value is out of   The above WARN message replace to ERROR message, please find the below ERROR message.   2023-11-06 15:30:48,941 ERROR pool-1-thread-1 com.veeva.brp.batchrecordprint.ScheduledTasks - Unknown error: {errorType=GENERAL,   How to write props .conf and transforms.conf configuration files. please help me.   Regards Vijay .K         ... View more

Hi All,   My requirement is source data records data need to be encrypted. What does process need to follow? Is there any possibly  props.conf ?   Please help me the process.   Regards, Vij  ... View more

Hi team,   My project Zone  1  have Deployment server , HF and (SH+Indexer) Zone 2  also  Deployment server ,HF and (SH+Indexer)  and don't have cluster  master   My requirement is set up  High availability server configuretion Zone1 and zone 2  , I have plan to set  up zone 2 search +indexer server -->setting s  -->indexercluster  --> here i will give masternode is deploymentserver of zone1   because of i don't have cluster master in my project, please guide me my requirement.     Vijreddy ... View more

Hi All,   Currently Development zone-1 HF and( SearchHead+Indexer ) single instance QA -HF,Deploymentserver and Deployment server Zone2 also same servers, but we dont't have Cluster master and all are implemented Windows System.   As per requirement need to be implement High availability servers Zone1 and Zone2.   please send me implemented steps for high availability servers.   Regards, Vijay ... View more

Hi Team,   my requirement is write request is one event and Change Item into another event, please help me how to break the events       12:49:28 PM WriteRequest Remotexxxxxxxxxx+=0 12:49:28 PM WriteRequest Remotexxxxxxxxxxxxxx-=0 12:49:28 PM WriteRequest xxxxxxxx=ABEMA150 12:50:22 PM ChangeItem StatusDevices.xxxxxxxx=1 12:50:22 PM ChangeItem CurrentTest.DateEnd=25.06.2023 12:50:22 12:50:22 PM ChangeItem CurrentTesxxxxxxx=2 ... View more

Hi All, Created test user and assign the viwer roles and provided read only access, the above screen not the test user not able to see the under the knowledge objects, how yo remove the knowledge objects? Please help me the process? I need to remove tags,eventypes,lookups,userinterface..................   ... View more

Hi Team,   Created test user and assign the viwer  role, and login to test Credentials and select the manage app setting operation  , it displayed the Splunk 404 Forbidden Error window displayed  again click here option displayed in the window  again click and login credentials and click the manage setting working .   How to overcome the 404 Forbidden Error? please help me.     Regards, Vijay .K ... View more