The UF clients is not capable to route data between UF clients. If you need to use a splunk tier to forward data, you should use the Heavy forwarder tier https://docs.splunk.com/Documentation/Splunk/7.3.2/Forwarding/Forwarderdeploymenttopologies#Intermediate_forwarding UF clients are capable to send data direct to indexer/heavy forwarder tier and does have the functionality to forward data. I get a part of text from this document -> https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/Abouttheuniversalforwarder "This manual discusses the universal forwarder and how to plan, download, install, and configure it. There are two other types of forwarders. To learn about heavy and light forwarders and how they forward data, see About forwarding and receiving data in the Forwarding Data Manual. To achieve higher performance and a lighter resource footprint, the universal forwarder has a subset of the functionality provided by a full Splunk platform deployment, specifically: Cannot search or index data. Cannot send alerts. Does not parse incoming data, except in certain cases, such as structured data or some forms of Windows data. Cannot send data to syslog servers as it has no syslog pipeline. Does not include a version of Python." ... View more

I suggest for you to visit this link -> https://www.splunk.com/blog/2019/08/14/what-s-new-in-the-splunk-machine-learning-toolkit-4-4.html and make this question at "Join the Discussion" to see if Splunk have plans to add such functionality ... View more

I really appreciated your feedback, thus I am not aware if this functionality will be supported in the future. thanks ... View more

I did a test in my personal splunk and it had worked get data from fields like "tag.name". May you have to revist your code to get it done properly. I created a csv file with 2 fiels, cod and tag.name and added fake data to match my VendorID code. Here is the command I used to search the respective VendID code at lookup table and output tag.name. I used a stat before apply the lookup command. index=main VendorID=* | stats count by VendorID | lookup lktest cod as VendorID Output tag.name | sort by tag.name https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Lookup! alt text ... View more

I would suggest the use of "tstats" command (Performs statistical queries on indexed fields in tsidx files). As you are running your queries on datamodels and datamodels create the tsidx files, so I believe this can be an alternative to speed up the results on your reports, but you have to rebuild your report again because tstats should be the first command starting in your query. check this link for tstats-> https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Tstats Here is a link with other commands that you can try as well -> https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Commandsbycategory#Reports ... View more

This is the expected datamodel behavior. Every time you have to edit the datamodel, the acceleration have to be disabled and when you enable it again, splunk will create the summary index to accelerate the output results from datamodel and it is based on the amount of data you have on the datamodel. for further information check these documents -> https://docs.splunk.com/Documentation/Splunk/7.3.2/Knowledge/Managedatamodels ... View more

As mentioned by richgalloway, you have to add the configuration path for "coldToFrozenDir" at indexes.conf not at inputs.conf. check this link here for further information https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Configureindexstorage#Attributes_that_affect_index_buckets See below a sample of configuration for "coldToFrozenDir" parameter setup at indexes.conf [web] homePath = volume:primary/web/db coldPath = volume:primary/web/colddb thawedPath = $SPLUNK_DB/web/thaweddb coldToFrozenDir = /opt/frozen/web ... View more

All the Splunk Enterprise comes with trial license version for 60 days. After this evaluation period, those messages are shown. If you want to remove those messages, you have two options: 1 - connect your instance to Splunk License Master from your company 2 - Purchase a license for your personal splunk box Note: If you select the option 1, please carefully about the data your are sending to this instance, because all the data that you indexed in your personal box will count against the company license, and maybe you can reach the day capacity license. Please read this document where you can have more details about how splunk is being licensing. https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/HowSplunklicensingworks ... View more

Per the error messages it seems the linux server is not able to find the Splunk server on the DNS server, so try to use the ipaddress of splunk server where the HEC is setup to receive the input for testing purposes. Here is a link to troubleshoot the HEC connections https://docs.splunk.com/Documentation/Splunk/7.3.2/Data/TroubleshootHTTPEventCollector#Setting_up_logging_with_configuration_files ... View more

The port is setup only on the global configuration. When you are creating the token, this parameter is not requested because the port that token will be used is port 8088 or any other port you had setup previously at the global configuration. My suggestion is to follow the procedure I provided and run the test that I suggested in order to make sure the token is properly configured and receiving data. The token configuration has to be done on a heavy forwarder to receive the data and send to indexers for indexing the data. Other important verification is how you can setup the token internally on your application to send the log. The curl command that I provide you is only a sample you can use to validate if the configuration is setup properly. ... View more

I am not playing too much with MLTK, so If I understood your question properly, the new version 4.4 of MKTL can work with multiple predicted fields, Please read this doc -> https://www.splunk.com/blog/2019/08/14/what-s-new-in-the-splunk-machine-learning-toolkit-4-4.html suggestion for you to deploy the MLTK v4.4 in a sandbox to play around and validate if you are able to use this functionality. ... View more

it is not necessary to have a partner ID, you have to create your id at Splunk first and after you are able to enrol on the free training here is a link to create your account https://www.splunk.com/page/sign_up?redirecturl=https://www.splunk.com/ ... View more

The first step is to learn the basics about Splunk. There are some free trainings that have to be completed within 30 days, and I strongly recommend you run those ones to increase your knowledge about splunk. Here is a link: https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html There are videos at youtube, see this link: https://www.splunk.com/en_us/training/videos/installing-splunk-enterprise-on-linux.html the documents to install Splunk Enterprise https://docs.splunk.com/Documentation/SplunkCloud/7.2.7/SearchTutorial/InstallSplunk ... View more

when you are setup an input, you have to full path to read the file. if the csv file name is sample.csv your input should be like this: [monitor://D:\foo\sample.csv] OR disabled = false index = foo_index sourcetype = csv CRCSALT = OR this stanza [monitor://D:\foo*.csv] to index all the csv files for further information please check this link: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#MONITOR: ... View more

In indexer cluster environment, the search head have to be connected to the cluster master and the pass4SymmKey have to be the same as you had deployed to cluster master and indexers as well. When I experienced this issue in past installations, I redeploy the cluster configuration again just to make sure there is no mistyped on the pass4Symmkey password. Please remember to restart the splunk service when you are removing the configuration to cleanup any issues. I mean, remove the configuration from cluster master, restart splunk service, remove the configuration from Search Head and restart the splunk service. after that, redeploy the configuration again. ... View more

I found this information, it was under this article at DevSplunk http://dev.splunk.com/view/event-collector/SP-CAAAE7E limits.conf The [http_input] stanza in the $SPLUNK_HOME/etc/system/default/limits.conf file controls HTTP Event Collector metrics data logging. Note: For information about all HTTP Event Collector-related parameters, including those not related to metrics, see the [http_input] stanza documentation on limits.conf in the Splunk Enterprise Admin Manual. Example [http_input] # the max number of tokens reported by logging input metrics max_number_of_tokens = 10000 the interval (in seconds) of logging input metrics report metrics_report_interval = 60 ... View more

I would to suggest to test the Rest Api commands, maybe this can fit your purpose. Check out this splunk answers-> https://answers.splunk.com/answers/438244/rest-api-to-re-trigger-report-using-saved-search-w.html For further information on Splunk Rest Api's check this document -> https://docs.splunk.com/Documentation/Splunk/7.3.2/RESTREF/RESTprolog ... View more

Please be more specific in your question. what is the app you referring to? In some case, you have to deploy an Add-on in order to input data to be indexed. The Add-on and App are the match to get a normalised data indexed and showed properly at the pre-build dashboards. In general, the apps and add-ons are developed to receive data into the default index, and the default index at Splunk is "main". When you deploy an App/Add-on, verify if the code is referring to a specific index or the default one. If you are still not able to get the data properly indexed, check if the input is collecting the correct source data, sometimes a troubleshoot is required to get data indexed properly. if the data is being indexed, check if the index is different from "main" index, maybe you should tweak a bit to run adjustments creating an eventtype to reference the correct index. I hope my post can help you. Happy Splunking!!! ... View more

Per the log information you had posted, there is a denied permission to run the child process "child failed to start: Permission denied". This lack of permission can be related with "exit code 1" from the app it self. Verify if the user that is running splunk service has the proper permission to run this TA app, it is common problem in linux environment for permission issues, but I dont know how the permission works at Azure because I never play with before. I would stop splunk service, re-apply the permissions and start splunk service. ... View more

Check if there is any error message at splunkd.log/web_service.log at $SPLUNK_HOME/var/log/splunk. I had similar issues in the past and I am not able to identify the root cause even doing some troubleshooting on the log files I mentioned. To fix the web server issues in my case, I have to reinstall Splunk using the same version already previously installed and it had worked. Try to revert the previous changes you had deployed to check it can be the root cause. Please run a backup first at the entire /etc folder before you deploy any changes, just to make sure you are able to recover all the configuration and apps. ... View more

The blacklist has precedence over whitelist, so in this case the blacklist will not index any data from security event 4688. "It is not necessary to define both a whitelist and a blacklist in a stanza. They are independent settings. If you do define both and a file matches both, the forwarder does not index that file as blacklist overrides whitelist." this note are from this document https://docs.splunk.com/Documentation/SplunkCloud/7.2.7/Data/Whitelistorblacklistspecificincomingdata My suggestion is to use this inputs.conf only [WinEventLog://Security] disabled = 0 index = test interval = 60 whitelist = 4688 sourcetype = Security4688 This props.conf [Security4688] TRANSFORMS-set = setnull,useronly4688 and the transforms, because here you are send all the security event 4688 and others to null queue, except those ones starting with S-1-5-21- [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [useronly4688] REGEX = S-1-5-21- DEST_KEY = queue FORMAT = indexQueue ... View more

Please try this one at props.conf using the host [host::server_sourcename] TZ = US/Central OR by source [source::your_source] TZ = US/Central OR by sourcetype [sourcetype::your_sourcetype] TZ = US/Central For further information, please check this document: https://answers.splunk.com/answers/135193/splunk-indexing-and-time-zone-normalization.html ... View more

In this link you have two files from Buttercup games https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Systemrequirements#Download_the_tutorial_data_files Download the tutorialdata.zip file. Do not uncompress the file. Download the Prices.csv.zip file. Do not uncompress the file at this time. I believe the tutorial is the same as you have, thus it is missing the Prices.csv.zip. I hope this help. ... View more

In this case, my suggestion is to run a new Splunk enterprise installation and when splunk will start for the 1st time, you have to type the new admin user requested by customer, check this doc https://docs.splunk.com/Documentation/Splunk/7.3.2/Installation/StartSplunkforthefirsttime. ... View more