Splunk Enterprise

Community Activity

	How to upgrade the universal forwarder agents in linux from 7.3.0 to latest version. I need to upgrade the universal forwarder agents on the multiple instance from the current 7.3.0 to the latest versio... by AviSharma8 New Member in Splunk Enterprise 04-03-2025 0 8	0	8
	Cannot find bid I'm getting thousands of log events that says --ERROR CMSlave [2549383 CMNotifyThread] - Cannot find bid=wineventlog~... by jfaldmomacu Path Finder in Splunk Enterprise 04-02-2025 0 6	0	6
	SSL enabled between deployment server and deployment client (UF) In my environment, I've setup the SSL communication and authentication between Deployment Server and its deployment c... by krusovice Path Finder in Splunk Enterprise 04-02-2025 0 8	0	8
	Splunk not receiving logs on heavy forwarder Hi. Recently I notice that the splunk heavy forwarder has stop receiving logs from network devices. We are using TLS... by splunkkk Loves-to-Learn in Splunk Enterprise 04-02-2025 0 6	0	6
	Avoid app update when deployer push bundle Hi Splunkers, today I have the following issue: on our SHC, there is a small app subset that is managed, and so modif... by SplunkExplorer Contributor in Splunk Enterprise 04-02-2025 0 2	0	2
	Splunk Deployment Servers Clustering HiPlease assist how to build Splunk deployment servers clustering with minimum requirement. by msmadhu Path Finder in Splunk Enterprise 04-02-2025 0 1	0	1
	alert_manager_enterprise/bin/house_keeping.py keep 14GB memory Is it normal for this script to run all the time and take up a lot of memory? Is there any way to reduce memory usag... by chengjiok Observer in Splunk Enterprise 04-02-2025 0 2	0	2
	Sentinel One Integration with Splunk Hi. I am new to Splunk and SentinelOne. Here is what I've done so far:I need to forward logs from SentinelOne to a si... by azer271 Path Finder in Splunk Enterprise 03-28-2025 0 6	0	6
	Azure AD Authentication URLs Returning 200 Response Code Even with Incorrect Credentials We are using the following PowerShell script to monitor Azure AD authentication-enabled URLs in Splunk. However, when... by Devika_20 New Member in Splunk Enterprise 03-28-2025 0 1	0	1
	cannot get schemas I'm experiencing an issue with the Splunk DB Connect app under Data Inputs > Choose Table where the Schema dropdown f... by sylee Engager in Splunk Enterprise 03-27-2025 0 9	0	9
	spl Hi All,I want a SPL query to get total size occupied/consumed by each index till now since the date of onboarding and... by SrinivasuluS Observer in Splunk Enterprise 03-25-2025 0 4	0	4
	How to send files from Splunk to SharePointOnline? Hi All,I need to automate the execution of specific queries in Splunk Enterprise on a weekly basis, export the result... by johnjohn Engager in Splunk Enterprise 03-24-2025 0 2	0	2
	What is the best way to set up ouptuts.conf in a clustered environment? There a about 3 ways to set up outputs.conf and when you trying to setup forwarders. you can either do a cli entry ... by domino30 Path Finder in Splunk Enterprise 03-24-2025 0 2	0	2
	Conditional tagging on an intermediate forwarder I have a configuration where I have an intermediate forward that is forwarding logs to central indexer that I do not ... by MichaelM1 Explorer in Splunk Enterprise 03-24-2025 0 13	0	13
	Privilege checks for Script Hello, teamI've made script, which uses the sudo command. I've deployed it on my forwarders and I get the error:messa... by msmadhu Path Finder in Splunk Enterprise 03-23-2025 0 14	0	14
	restrict a role by source IP Hello, is it possible to restrict Splunk roles by source IP?example:Splunk role: my_user_role, allowed source IPs 172... by Andre_ Path Finder in Splunk Enterprise 03-23-2025 0 9	0	9
	mvexpand is heavy is there another way HiI have the following data.I am looking to get a line per data, so I can work with it better.If I use mvexpand I hit... by robertlynch2020 Influencer in Splunk Enterprise 03-20-2025 0 13	0	13
	frozenTimePeriodInSecs only takes effect on IDX restart Hello,I have defined a frozenTimePeriodInSecs for 1 hour on my IDX for a certain index, so that the logs it contains ... by MrLR_02 Explorer in Splunk Enterprise 03-20-2025 0 3	0	3
	Does not meet: primacy & sf & rf There was a time when the indexer server shut down unexpectedly, And I've been struggle with indexer clustering rf & ... by blanky Explorer in Splunk Enterprise 03-19-2025 0 7	0	7
	Finding Duration and formatting output I'm having trouble getting my duration into the format I'd prefer... I'd like to see the duration to be MM:SS. Howeve... by scottmkirkland Explorer in Splunk Enterprise 03-19-2025 0 6	0	6
	time modifiers Here is the situationSearch web security appliance data (index=network sourcetype=cisco_wsa_squid) for non-businessac... by Sukhmeet New Member in Splunk Enterprise 03-19-2025 0 1	0	1
	installing CA signed cert - TLS certificate is missing or invalid Hi,I am working on installing CA-signed (ssl.com) cert to a splunk enterprise instance, and keep hitting these two er... by Space_Crawler Observer in Splunk Enterprise 03-19-2025 0 3	0	3
	Is saturation level fine as a preparation for additional HEC data stream? For our indexers, we see the following under 'Storage I/O Saturation (Mount Point)' - 0.90% (/opt/splunk) 6.56% (/ind... by danielbb Motivator in Splunk Enterprise 03-18-2025 0 1	0	1
	How convert time format Hi , How to convert 2025-03-13T11:03:38Z to the "%d/%m/%Y %I:%M:%S ".I have tried this, but it didn't work.\| eval Las... by Nraj87 Explorer in Splunk Enterprise 03-17-2025 0 3	0	3
	indexaccess on appcontext basis Hi splunkers,is it possible to restrict indexaccess to specific appcontext?like a user has read access to app a and w... by TheEggi98 Path Finder in Splunk Enterprise 03-14-2025 0 2	0	2