Hi @SplunkExplorer  In theory you will loose access at the point the contract/stack expires. From experience its usually slightly after that Splunk start the decommissioning of your stack but I wouldnt bet on it. I dont know if there is anything in your contract about access after the expiration but again I wouldnt image you are 'allowed' to access it after your contract/license expires. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @Jayaraman  Do you currently have a Splunk Cloud Trial or are you self-hosting a Splunk instance? Ultimately the URL and token will certainly change if you are going from a trial or self-hosted instance to a production Splunk Cloud stack - During the setup of your production cloud stack you will be asked for a prefix/stack name to use which will be <stackName>.splunkcloud.com The HEC endpoint address will end up being https://http-inputs-<stackName>.splunkcloud.com/  You will need to create a new HEC token on your production stack for your data ingestion, there is no way to specifically set a token, it is a random GUID therefore you will need to update you data source with the new URL and Token to start sending your data to a production stack.  Note that its not typically possible to migrate any existing indexed data from a trial stack into Splunk Cloud production stack. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi Ricah, This really depends on where the data is coming from, what format its in, if its already parsed (e.g. sent via HEC) etc. There may be existing Splunk apps for the data if its a common log type (e.g. AWS logs, PaloAlto logs, Nessus, Windows/Linux logs etc) - Check https://splunkbase.splunk.com/ for suitable apps and install them on your stack as these will help you out.  I'd always recommend testing locally first if this is possible - either a development stack, internal on-premise dev instance or even a docker container or local install.  Have you done the Splunk Architect training courses? I believe Data Administration is a key part of the admin / architect training (https://www.splunk.com/en_us/training/course-catalog.html?sort=Newest&filters=filterGroup2SplunkEnterpriseCertifiedArchitect) so might be worth getting yourself up to speed if you havent already done so. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @wreadToad  If you want to start having a play with Splunk and to get familiar without having to install it locally then a Splunk Cloud trial can be a good place to start. For more info on that check out https://www.splunk.com/en_us/download/splunk-cloud.html In terms of other resources - there are a bunch of free training courses at https://www.splunk.com/en_us/training/free-courses/overview.html which is definitely the best place to start learning how to use Splunk.  If you want to learn more about *running* Splunk then it would be worthwhile installing it locally so that you can understand the process etc, but the above would be where I'd start. For your first project you might like to try out the Search Tutorial at https://help.splunk.com/en/splunk-enterprise/get-started/search-tutorial/10.0/introduction/about-the... which goes through uploading and searching some data. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @danielbb  You can upgrade from 9.3.3 directly to 10.0.1, the docs for this version arent super clear (https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/10.0/upgrade-or-migrate-splunk-enterprise/how-to-upgrade-splunk-enterprise) but they do confirm that you can go from 9.3.x to the latest 10.0.x version. Alternatively you could upgrade the the latest 9.3.x or 9.4.x versions if you arent wanting to move to 10.0.x 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @samp  You could use something like this: | makeresults count=6 | streamstats count as n | eval ip=case(n=1,"100.15.1.10", n=2,"100.15.99.5", n=3,"100.36.7.8", n=4,"100.36.200.1", n=5,"100.99.1.1", 1=1,"10.0.0.1") | search [| makeresults | eval user_input="100.15.*;100.36.*" | eval ip=split(user_input,";") | fields ip | format] This uses a search: [| makeresults | eval user_input="100.15.*;100.36.*" | eval ip=split(user_input,";") | fields ip | format] To search for the IPs that match the specific pattern/input - You can replace this with a token e.g. $my_ip_list$ etc as required, and you can move it into the initial search command rather than limit later down the search depending on your requirements. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @ParsaIsHash  Just to follow up on this, Ive had confirmation that the page has now been updated to include 9.4.7 confirming compatibility with the following ES versions: 7.3.2, 7.3.3, 7.3.4 8.0.2, 8.0.3, 8.0.40, 8.1.0, 8.1.1, 8.2.0, 8.2.3, 8.3.0 https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-products-version-compatibility/splunk-products-version-compatibility-matrix 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @ParsaIsHash  For official confirmation you should reach out to Support - they should be able to provide the official stance on this. In the meantime I have reached out to the relevant team to update the compatibility matrix page with 9.4.7. Based on the other 9.4.x compatibility, I would say its safe to *assume* that the 9.4.7 will be the same, but given that your situation is a large SOC migration I would seek official confirmation via Support (or your Splunk account team) if the documentation page is not updated in time for your migration. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @jiriwetter  Where did you find the url /v2/private-locations ?  Can you confirm that you are talking about Splunk Synthetic private location? From what I understand, you need to first create the private location if not done so already: curl -X POST "https://api.{REALM}.signalfx.com/v2/synthetics/locations" \ -H "Content-Type: application/json" \ -H "X-SF-TOKEN: <value>" \ -d '{ "location": { "id": "private-data-center", "label": "Data Center" } }' You would then request a runner token for that location: curl -X POST "https://api.{REALM}.signalfx.com/v2/synthetics/locations/{location_id}/runner_tokens" \ -H "Content-Type: application/json" \ -H "X-SF-TOKEN: <value>" You would then use the token received to create you private location runner: https://help.splunk.com/en/splunk-observability-cloud/monitor-end-user-experience/synthetic-monitoring/advanced-test-configurations/private-locations 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @inventsekar  Its my understanding that typically it will be the Author of the post (the person asking the question) that I would expect to add Karma to a reply if it helps them - however after speaking to some community members in the past they did not really realise that adding karma to a post was "a thing" and so you may have seen some users such as myself adding a footer encouraging the author to add karma and/or accept a solution if the answer helps.  To me, receiving karma gives me assurance that my answers on here are helping the people asking the questions - often answers get no feedback from the author so its hard to know if you've added value for them or not! For some reason authors rarely accept a solution - im not really sure why this is either... I do sometimes find (as you might have seen from your last thread) that you can get the same answer from 3 different people...I generally try not to reply if I'm going to say the same thing as someone who has already answered, however if I have additional points/context/clarity to make then I will post even if some of the answer is the same (e.g. posting a link to the relevant documentation to backup someone else's previous answer). On the other hand, I have seen a pattern of users who will literally say the exact same thing (even sometimes using sample queries I have written) to answer the question, ultimately there isnt much we can do about that but I have noticed that sometimes their post will be accepted as a solution which is obviously a little frustrating when you've already put the effort in.. From what I can tell there are a few different personas on here: * The Asker - Someone who needs help from the community on a specific problem, or wants to learn more about a particular challenge or area. These users will typically leave a karma for replies and thus give a relatively small number of karma and receive none (or very few) * The Answerer - Someone who generally spends their time only responding to new answers that come into the forum - these users typically receive a higher number of karma and leave much fewer as their responses are typically for the purpose of helping others or participating in a conversation. Occasionally these users will like other answers in the same thread as their own, for example if another user highlights issues with the answer they have given or gives a better way of achieving something - I find myself giving karma where someone has challenged my response or provided a good alternative view which is a way for me to acknowledge that they have helped me. * The Browser - Someone who doesnt always provide answers, but spends time reading other questions/answers within the community - these users often do so to learn about other people's challenges or issues to help them learn troubleshooting techniques or more detail about certain aspects of Splunk.  Of course, there may be others that I have missed, and there are probably users who do a mixture of all of these - Personally I get a 'buzz' from being able to answer questions that challenge me and will often go to great lengths to try and provide an answer (Its not unusual for me to spend an hour putting together some testing/data/scenario) to help answer a specific question - so therefore receiving karma for me is how I justify my investment into the community, but I totally understand that different people have different views on this kind of thing! I'd be interested to see what other people think though!  Will ... View more

Hi @trevorharris  The latest version of this app was released before 10.0 was announced and could be as simple that it has not been tested in Splunk 10.0 by the developers. It does state support for 9.4 though; Python 3.9 is the default interpreter in both 9.4 and 10.0 although 3.7 was still present in 9.4 so in theory this app could be pinned to using Python 3.7, but not usually something Ive seen. My recommendation would be to try and run the app in a non-production environment and check to see how things go, often I find things just work fine but you can never really know! 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @inventsekar  I think there is some conflusion here, the command referred to in that other post are system/CLI/shell commands, not SPL commands. As fair as I know there is no `splunk` SPL command. For docs on the CLI splunk command please check out https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.0/administer-splunk-enterprise-with-the-command-line-interface-cli/administrative-cli-commands 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @kn450  Can you confirm the Splunk version and SOAR Export app version you are using please? Did this start suddenly or has it been a problem for some time? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @muzicman0  If you can share the JSON code for the dashboard I can look at why this isnt aligning for you.   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @verbal_666  Regarding Question 2 - It is expected behaviour that scripts not in the manifest file are deleted during an upgrade. This is a security enhancement in 9.1.5, 9.2.3, 9.3.5 or 9.4.0 and above.  Scripts should really be placed within a custom app in $SPLUNK_HOME/etc/apps/<app_name>/bin/ Check out https://splunk.my.site.com/customer/s/article/Shell-scripts-are-missing-after-upgrading-the-HF-to-v9-2-3 for more info on this. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @jatin3101  Can you confirm the specific command you are running? If the SH is already part of a cluster then its likely you can push out the relevant configuration via the SH Deployer For example: # server.conf [clustering] manager_uri = https://yourCM:8089 pass4SymmKey = topSecretPassword This should connect the SHC members to your IDXC. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

Hi @TheBravoSierra  Was the app originally installed via the SH Deployer? If so you should be able to remove by removing the app from  /opt/splunk/etc/shcluster/apps as you suggested, however this will only work if the app was installed from the SH Deployer *and* the app is not disabled. https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges "To delete an app that you previously pushed, remove it from the configuration bundle. When you next push the bundle, each member will delete it from its own file system. Note: If you need to remove an app, inspect its app.conf file to make sure that state = enabled. If state = disabled, the deployer will not remove the app even if you remove it from the configuration bundle." 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @verbal_666  If the filename is the same each day and the first <x> chars of the log are the same each day then you need to set the initCrcLength to be greater than the number of non-unique characters between days. e.g. if the header is 1000 chars and the next line is a date like 2025-12-03T12:34:56 then you probably want to include the length of the date string too. All the crcSalt value of '<source>' does is append the filename to CRC calculation, so it'd be your "initCrcLength" number of chars followed by the filename. Ultimately if the initCrcLength value is too small then it wont detect the change, I dont think the salt value really makes any difference in this scenario? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @reach2tushar  As far as I know this isnt possible with any of the current Service Now addons in Splunkbase, but can you confirm which app you are using and I can check further?  What specifically is it you are looking to attach to the incident? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Hi @SN1  Are you able to confirm if the input queue was blocked on the receiving server (e.g. another HF or your indexer)? The log suggests that for a small period of time it could not connect to the indexer/HF. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

@NullZero you mentioned that auditd_host_inventory on the indexers have a number of events, it looks like the default for the collections in the TA-linux_auditd app is for the collections to replicate to the indexers. # collections.conf [auditd_host_inventory] replicate = true [learnt_posix_identities] replicate = true Therefore I am not sure if disabling KV Store on the indexers when this is set on the SHC would cause any issue? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more