Hi @arthurkroth  According to the docs at https://help.splunk.com/ja-jp/splunk-enterprise/get-started/install-and-upgrade/10.0/plan-your-splunk-enterprise-installation/system-requirements-for-use-of-splunk-enterprise-on-premises version 10.0.2 IS supported with Windows Server 2016 for Universal Forwarder (not HF or other Splunk Enterprise installs) I would recommend raising a support case with the details you posted and hopefully they can look into this for you. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @emborden  Please can you confirm which sandbox server you are using? Is this a <something>.splunk.show address? The people who manage these instances dont usually respond here, if you have a support entitlement for another instance you might be able to raise a support ticket and let them know the details, alternatively you might be able to call support using your local support contact number from https://www.splunk.com/en_us/customer-success/support-programs.html?locale=en_us 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @rohitkattewar  Please could you give us some more information about your setup? Are you running locally on your machine or hosted elsewhere? What is the link it is redirecting you to?  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @tkwaller1  How would you then search this data? Do you have a license to ingest data on-premise if you are using Splunk Cloud?  If you really need to do this and have a license for it then its not *really* just a forwarder anymore...but anyway..! I think if you set _TCP_ROUTING = (empty value) in your inputs.conf stanza for the file then this will override the  default forwarding target group for that specific input only, forcing the Heavy Forwarder to index the file locally while preserving Splunk Cloud forwarding for all other data.   [monitor:///path/to/your/file.log] index = local_index_name sourcetype = your_sourcetype _TCP_ROUTING = disabled = 0   Splunk interprets the empty assignment as "route to no target groups." Since Heavy Forwarders possess indexing capabilities, the data enters the local indexing pipeline. It goes without saying that this isnt typical/best practice and may have other implications! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @harman  If your dates are in dd-mm-yy  format then you need to specify a TIME_FORMAT value for your sourcetype, how you do this will depend on your setup - are you using a single instance through the UI to add this? If so when you're adding through the "Add Data" section then add the following: TIME_FORMAT=%d-%m-%y   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @Jackie1  You will need to speak with ManTech to find out what agreements they have with Splunk for free/paid for training. To get started you probably want to look at the User Certification - check out https://www.splunk.com/en_us/training/certification-track/splunk-core-certified-user.html for more information on this. In the meantime, you can start today by looking at the free courses available at https://www.splunk.com/en_us/training/free-courses/overview.html which create a foundation required to take on the further paid-for training and certification tracks. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @hordoffa1970  As the error suggests, it looks like something is already listening on port 9997.  What exactly is it you are trying to do? Do you already have an inputs.conf configured to receive data (or is something else on your system using port 9997)? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @leykevin  You can reach the developers of this app at support@rapid7.com - if you log the request directly with them they can hopefully provide you an update on this. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

There are now 2 Knowledge base articles about this so its an acknowledged issue with these releases and hopefully patched in the next release (I'll keep an eye out!) The following KB links might be useful for others who find this, but it pretty much repeats what is in the original post: https://splunk.my.site.com/customer/s/article/Splunk-Web-503-errors-after-9-4-8-upgrade-on-offline-deployments https://splunk.my.site.com/customer/s/article/Error-503-Splunkd-daemon-cannot-be-reached-by-Splunk-Web-after-upgrade-to-9-4-8-10-x-versions 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @verbal_666  Its my understanding that this is normal behaviour.  Ultimately you are setting latest < 23:59:59 - and something like 23:59:59.124 is greater than it, therefore it wouldnt be incluced.  If you do something like earliest=-2d@d latest=-d@d it will snap to midnight not 23:59:59 2/15/26 12:00:00.000 AM to 2/16/26 12:00:00.000 AM 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @alvaro_delamata  What is the source of your data? Is it mainly coming Splunk2Splunk via Forwarders? HEC? Modular/Data Inputs? If you want to ensure data integrity then the only real way would be to catch it on the way in to Cloud, so things like Ingest Actions to send to S3 probably wouldnt be a good idea. On the other hand, using Ingest Processor would probably give you the flexibility you need here as I believe you should be able to send to two destinations (https://help.splunk.com/en/data-management/process-data-at-ingest-time/use-ingest-processor/9.3.2408/route-data-using-pipelines/routing-data-in-the-same-ingest-processor-pipeline-to-different-actions-and-destinations) It may ultimately depend on where the data is originating. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @maiteosaba  It looks like this is a permissions issue and you do not have the relevant permissions to the app which you are wanting to share the dashboard in.  Please speak to your Splunk admins and ask that you are given the relevant access so you can share your dashboards within the app.  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @STCK  If you're using Classic XML dashboards then check out https://community.splunk.com/t5/Splunk-Search/Column-width/m-p/309645/highlight/true#M92893 There is a 'Table With Custom Column Width' dashboard example in the Splunkbase Dashboard Examples app https://splunkbase.splunk.com/app/1603 If you are using Dashboard Studio then you can use 'columnFormat' a bit like this: { "type": "splunk.table", "options": { "columnFormat": { "host": { "width": 120, "textOverflow": "anywhere", }, "count": { "width": 300 } } }, "dataSources": { "primary": "ds_1FL3tRPy" }, "context": {}, "containerOptions": {}, "showProgressBar": true, "showLastUpdated": false } 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Dabbsy  Its worth pointing out that 'Additional Splunk Enterprise 10.0.3, 9.4.8, 9.3.9, and 9.2.12 advisories will be released on February 18th, 2026.' so it may be added then.  You might also be interested in https://community.splunk.com/t5/Splunk-Enterprise/log4j-exploit-how-do-I-remedy/td-p/758091 For what its worth, from my findings I found log4j 2.17.2 in <=9.4.8, <=10.0.3 but NOT in 10.2.0 These were found in $SPLUNK_HOME/bin/jars/thirdparty/common/ in Splunk Enterprise <= 10.0.3 but bear in mind that other Splunkbase apps like ITSI may have their own jars. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Jayaraman  There is nothing that I can think of that would stop an app being visible following an upgrade, even if there was an issue with something like python version you would still see the app. Can you confirm the app exists in $SPLUNK_HOME/etc/apps/<appID> ? Do the permissions match the user that runs Splunk as? And matches the other apps? To clarify, there was no 10.1.x for Splunk Enterprise (Cloud only) - I assume you came from 10.0.x to 10.2.0 ? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @prashanthan1987  Do you mean host field doesn’t show in the selected fields on the left hand side? Does it show under Interesting Fields?  Has the user created any custom field aliases or eval which could be overwriting the host field for them?  ... View more

Hi @fkabell  How many IPs are we talking? If you use a subsearch you'll be limited by the subsearch event count limitations (10,000 if I recall). If you have a lookup CSV/KVStore then you can determine if there is a matching value in the lookup and then remove those leaving your non-hostile addresses. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @mangothrow  Im sorry Im not too familiar with deslicer's version of the Splunk MCP Server but if you can share your redacted configuration I can help you look into it. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @radko  One thing you might like to investigate is setting up a persistentQueue in the outputs.conf tcpout group - this is available in > Splunk 9.4.0 For more information on this check out https://community.splunk.com/t5/Knowledge-Management/New-Splunk-TcpOutput-persistent-queue/m-p/707340 this might help with the outages if queues are filling up (for example). Im wondering what else could be affecting it - do the files rotate?  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @ijung  The app does not have compatibility for 10.2 enabled in it's Splunkbase settings so it possibly hasnt been verified in 10.2 yet, or there could be a new version on the way.  This is a Splunk supported app so I would expect the best way for a Splunk Cloud user/customer to get this is installed would be via Support and they can hopefully help. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @spl_aficionado  If you dont want to index the CSV fields then you probably want to configure an EXTRACT in props.conf and exclude the INDEXED_EXTRACTIONS so it has no value. # props.conf [yourSourcetype] #Update the regex as appropriate for your CSV file EXTRACT-myCSVExtraction = (?<field1>[^,]+),(?<field2>[^,]+),(?<field3>[^,]+) 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Abass42  There is a good page at https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/administer-the-app-key-value-store/preparing-custom-certificates-for-use-with-kv-store which walks you through how to ensure your certificate is correct for KV Store usage as well as how to setup your server.conf for your custom KV Store, so I would recommend checking it out! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more