| | I am trying to identify the user or process responsible for stopping the Splunk UF agent. What log source do I requir... 0 2 | 0 | 2 | |
| | Dear fellas,I have an issue on Monitoring Console that show wrong information of instance after upgrade from 9.2.2 up... 0 6 | 0 | 6 | |
| | I have configured an app and added 7 different source files in a single inputs.conf with the same index name and sour... 0 6 | 0 | 6 | |
| | Hi, We have configured a data input in HF and there is an option to select index there. I have created new index in C... 0 35 | 0 | 35 | |
| | I'm trying to extract endpoint data from Cortex XDR, but I don't want to see just alerts in Splunk—I need all the end... 0 3 | 0 | 3 | |
| | I am having difficulty converting event logs to metric data pointshttps://docs.splunk.com/Documentation/Splunk/9.4.0/... 0 1 | 0 | 1 | |
| | Splunk Cloud had an update this past Sunday, 3 Mar 2025. Since then, admins are unable to change a user's role. Is th... 0 5 | 0 | 5 | |
| | HelloUsing Splunk 9.3.2I want to deploy an app to all Windows UF only. This config doesn't work. [serverClass:scalluf... 0 2 | 0 | 2 | |
| | I'm new in Splunk and have a test environment contains search head cluster with three Splunk 9.0.1 instances: one dep... 0 2 | 0 | 2 | |
| | I have 3 new splunk enterprise. 2 are acting as search heads and 1 is acting as deployer.I have successfully made the... 0 2 | 0 | 2 | |
| | I want to send the all the event to nullqueue except having match "EventType": 5000. {"EventID": 2154635, "EventType"... 0 5 | 0 | 5 | |
| | input: {author=John, book=Splunk } output table author book John Splunk 0 4 | 0 | 4 | |
| | The current version is not available for the cloud.According to conversations with Splunk Support, the update address... 0 3 | 0 | 3 | |
| | Hello there. I would like to ask about Splunk best practices, specifically regarding cluster architecture. One sugges... 0 2 | 0 | 2 | |
| | Hello,I am attempting to forward data from an older indexer to a new indexer so that I can decommission the server th... 0 4 | 0 | 4 | |
| | Hi All,Is it possible to use Splunk for tracking logs from SAP CPQ, CPI, C4C? I couldn't find relevant information re... 0 5 | 0 | 5 | |
| | Hello,I am trying to collect bash_history logs in real-time from multiple Linux hosts using Splunk. I have deployed t... 0 6 | 0 | 6 | |
| | we have a scenario where we roll logs everyday. we want Splunk to index log file for yesterday only. We don't want to... 0 5 | 0 | 5 | |
| | I have around 800 users in my environment and the count of 4624 and 4634 is around 80,000 for the last 15 minutes. Wh... 0 5 | 0 | 5 | |
| | The GUI is sooooo slow. If you run a search results are pulled in fast, the page is already loaded. The problem is wh... 1 9 | 1 | 9 | |
| | We have an existing Splunk 9.1.3 Enterprise environment and run Splunkweb at port 8000 using an outside CA signed cer... 0 8 | 0 | 8 | |
| | I have a file I'm monitoring that changes several times a day. It is likely that sometimes the file contents will be ... 0 1 | 0 | 1 | |
| | What is the best practice to have a Splunk heavy forwarder call out to a third party API and pull logs into Splunk. M... 0 2 | 0 | 2 | |
| | We are using the Splunk Add-On for GWS Version3.0.3 for Splunk Cloud and receiving this error when attempting to pull... 0 1 | 0 | 1 | |
| | I'm looking for support on my $xmlregex Blacklist. I have checked as many previous tickets as I can and I'm still stu... 0 1 | 0 | 1 | |
