https://community.splunk.com/t5/Alerting/Query/m-p/681454#M15843 <P>Is there a way to create a query to show the errors from splunk TA and kv store&nbsp;</P> Wed, 20 Mar 2024 20:36:40 GMT whitecat001 2024-03-20T20:36:40Z https://community.splunk.com/t5/Alerting/Query/m-p/681454#M15843 <P>Is there a way to create a query to show the errors from splunk TA and kv store&nbsp;</P> Wed, 20 Mar 2024 20:36:40 GMT https://community.splunk.com/t5/Alerting/Query/m-p/681454#M15843 whitecat001 2024-03-20T20:36:40Z https://community.splunk.com/t5/Alerting/Query/m-p/681964#M15859 <P>You should find all neccessary information about Splunk TAs and the kv store in your "_internal" index.</P><P>As a second step you could check the "source" field for the TAs that you want to monitor. Most of the available TAs are writing logs in their own logfile under&nbsp;<SPAN><STRONG>$SPLUNK_HOME/var/log/splunk</STRONG>.&nbsp;</SPAN></P><P>For the kv store check the mongod.log.</P><P>More information:</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.2.0/Troubleshooting/WhatSplunklogsaboutitself" target="_blank">What Splunk software logs about itself - Splunk Documentation</A></P> Tue, 26 Mar 2024 08:09:57 GMT https://community.splunk.com/t5/Alerting/Query/m-p/681964#M15859 PaulPanther 2024-03-26T08:09:57Z