Generally speaking.. 1) Alerts are created for monitoring a threshold and get email notification (or other tasks like incident creation, etc) 2) Reports are created for daily/weekly/monthly reports generation(generally on a large dataset) and email the reports.  3) Dashboards are created for viewing/checking/showcasing the current status of a search query/system.  So generally you will not required email notification from dashboard. hope you got it. thanks.    As you are a new member, let me update you that, karma points / upvotes are appreciated by everybody. thanks. 

Hi @jerome ... troubleshooting this requires mooore details from you. 1. from the UF, are you able to receive other logs to indexer? 2. was this java logs showing up at indexer previously or.. it did not work from you have configured 3. is it a prod or test system... 4. your inputs.conf at the UF configuration please

I created the index via splunk and have a log4j-spring.xml file where I have the necessary configurations for splunk see below: I'm using log4j as the logging mechanism in my application. <?xml version="1.0" encoding="UTF-8"?> <Configuration> <Appenders> <Console name="console" target="SYSTEM_OUT"> <PatternLayout pattern="%style{%d{ISO8601}} %highlight{%-5level }[%style{%t}{bright,blue}] %style{%C{10}}{bright,yellow}: %msg%n%throwable" /> </Console> <SplunkHttp name="splunkhttp" url="http://localhost:8088" token="*******" host="localhost" index="gam_event_pro_dev" type="raw" source="gameventpro" sourcetype="log4j" messageFormat="text" disableCertificateValidation="true"> <PatternLayout pattern="%m" /> </SplunkHttp> </Appenders> <Loggers> <!-- LOG everything at INFO level --> <Root level="info"> <AppenderRef ref="console" /> <AppenderRef ref="splunkhttp" /> </Root> </Loggers> </Configuration> I have admin access to our splunk account so permission should not be an issue.

I created the index via splunk and have a log4j-spring.xml file where I have the necessary configurations for splunk see below: I'm using log4j as the logging mechanism in my application. <?xml version="1.0" encoding="UTF-8"?> <Configuration> <Appenders> <Console name="console" target="SYSTEM_OUT"> <PatternLayout pattern="%style{%d{ISO8601}} %highlight{%-5level }[%style{%t}{bright,blue}] %style{%C{10}}{bright,yellow}: %msg%n%throwable" /> </Console> <SplunkHttp name="splunkhttp" url="http://localhost:8088" token="*******" host="localhost" index="gam_event_pro_dev" type="raw" source="gameventpro" sourcetype="log4j" messageFormat="text" disableCertificateValidation="true"> <PatternLayout pattern="%m" /> </SplunkHttp> </Appenders> <Loggers> <!-- LOG everything at INFO level --> <Root level="info"> <AppenderRef ref="console" /> <AppenderRef ref="splunkhttp" /> </Root> </Loggers> </Configuration>

And what is it that you did? Because "all required integration steps" doesn't say anything. Are you writing your logs to files and ingesting events from those files? Are you sending directly to splunk from your app? If so - how and to which component? If you configured the process with a specific destination index - are you sure that the user you're checking it with has proper permissions to access that index? Just a few questions to start.

10 years ago there was a module called of all things "splunk" that you could use to connect to an instance and pull data out. The connect cmdlet was called Connect-Splunk and was part of the module set.

I couldn't find those details, either.  I think they're one of those companies that hide their documentation so you may need to sign in to their customer portal (there's a link at the bottom of the page).

I haven't used the importtool myself but the logical thing to do is to run it on an indexer. If you run it on the master, it has no way of replicating the data to indexers because master is  not a part of the "replication group"

Hi @sigma, did you tried from Search Heads using the collect command (https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Collect)? In other words: you run a search on one index and then you use the collect command: index=old_index | collect index=new_index Obviously you can define the time period to export. Ciao. Giuseppe