“This view has a Splunk.Module.HiddenSearch module but it is configured with no child modules to push its changes to. This represents a configuration error.”

There is someone who posted on splunk answers the same error, and someone wrote back and said to comment-out line 24 and to add line 78. But that totally does not work and causes yet another error (I saw this at http://splunk-base.staging.splunk.com/answers/5672/error-on-dashboard-splunk-agent-monitoring-app ).

I have the monitoring script working okay, so it is the $SPLUNK_HOME/etc/apps/splunk_monitoring/default/data/ui/views/dashboard.xml that is apparently the problem. Suggestions?

We’ve even pared down the number of logs down to just a couple and the CPU is still at 50%; it seems way to high and I don’t know how to fix this. Have you encountered this before?

We are using Splunk v4.2.1-98164.

We use the Splunk deployment server so I created a deployment app under “$SPLUNK_HOME/etc/deployment-apps/mybundle/default”. It contains a fields.conf file with the values:

[niappname]
INDEXED = true

[nilogname]
INDEXED = true

An indexes.conf file with the values:

[ni_dashboard]
homePath = $SPLUNK_DB/ni_dashboard/db
coldPath = $SPLUNK_DB/ni_dashboard/colddb
thawedPath = $SPLUNK_DB/ni_dashboard/thaweddb

A inputs.conf with the values:

# Scripted input to do a find on /opt/apps/logs
[script://$SPLUNK_HOME/etc/apps/mybundle/bin/apploglist.sh]
interval = 3600
sourcetype = dashboard_app_log_list
source = ni_dashboard
index = ni_dashboard
disabled = false

A props.conf file with the values:

# Handler for apploglist.sh “dashboard_app_log_list” sourcetype
[dashboard_app_log_list]
BREAK_ONLY_BEFORE = ^
TRANSFORMS-applist = apps,logs
AUTO_LINEMERGE = True
SHOULD_LINEMERGE = False

The most important part is to set up your transforms.conf with the proper regex like this:

# Add “niappname” field for apploglist.sh “oas10g_app_log_list” sourcetype
[apps]
REGEX = /opt/apps/logs/(\w+)/
FORMAT = niappname::$1
DEST_KEY = niappname
WRITE_META = True

# Add “nilogname” field for loglist.sh “oas10g_app_log_list” sourcetype
[logs]
REGEX = /opt/apps/logs/(\w+)/(\w+)\.|/opt/apps/logs/(\w+)/_apps_utf8/(\w+)\.
FORMAT = nilogname::$2
DEST_KEY = nilogname
WRITE_META = True

Then you still need to create your script. I put mine under “$SPLUNK_HOME/etc/deployment-apps/mybundle/bin” so it will get deployed with the deployment server. Here is my script:

#/bin/bash

# VARIABLES
LOG_DIR=”/opt/apps/logs”;
DST_DIR=”$SPLUNK_HOME/etc/apps/mybundle/log”;

# Hostname
HOSTNAME=`uname -n`;

# Check if DST_DIR exists and if not create it
if [ ! -d ${DST_DIR} ] ; then
mkdir ${DST_DIR};
fi

# Check if log file exists and if not create it
if [ ! -f ${DST_DIR}/${HOSTNAME}_apploglist.log ] ; then
touch ${DST_DIR}/${HOSTNAME}_apploglist.log;
fi

# For each application directory
for i in `find $LOG_DIR -type f`
do
# If that directory has not already been indexed
if [ "`grep $i ${DST_DIR}/${HOSTNAME}_apploglist.log`" == "" ] ; then
# Add it to the log file
echo $i >> ${DST_DIR}/${HOSTNAME}_apploglist.log;
# Output it to stdout
echo $i;
fi
done

That should do it!

Thank you for taking the time to write this article and sharing your experiences. I have a similar setup to your with all app logs being written to /logs/webapps/* . Can you share how you configured your scripted input with your setup? Would it be possible to post the script that you use for this?

thanks so much

http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage

I see exctly what you’re talking about with the 4.x version of my Splunk License Usage app not showing up. It worked fine while I was logged in to Splunkbase, but not that I’m not logged in anymore, it just shows the 3.x version of the app. I’ve contacted Emma Dannin and Caleb Poterbin at Splunk support as they helped me get my app on the new Splunkbase. I will update you once it has been made available. Thanks!

A very helpful article. I’m in the process of setting up splunk and was looking at you license usage script for version 3.x. On Splunkbase, however, the script is still only for version 3.x. At least I can’t find it and the link you provide above takes me to the 3.x version of it.
Have to take a look at the monitoring after the weekend.
cheers,
madsen