Hi, In the Splunk configs does true/false means 1/0 ?? example: In transforms.conf we have MV_ADD = [true|false] , can we use MV_ADD = [1|0] in the CLI ? Does it imply the same ? Thanks ... View more

Hi @gaurav_maniar @larmesto I have enabled the modular input for getting data from the Elasticsearch into Splunk and it is working and getting the data in. But I am not sure how the interval is suppose to work. It is pulling in the same data again and again with everytime the input runs in the interval. Is it supposed to work that way ? Thanks, Nawaz. ... View more

Hi, Does anybody know how to pull the smallest or the largest value in a multi value field ? | makeresults | eval h="1234,1" | makemv delim="," h I want the output as the lowest of the values in the multi value field . that is "1" Thanks ... View more

Hi, We have a indexer cluster running on 6.5.3 and a search head running on same version,. We want to install a independent search head that is running on 7.3.0 and connect it to the indexer cluster. Will that cause any issues ? Thanks ... View more

Hi, I am trying to install Splunk on EC2 using bootstrap script. i.e, Splunk should be installed as soon as EC2 instance is being created. Does anyone have a script or a process to install Splunk in the way mentioned above. Thanks ... View more

Hi, I am seeing some KV store replication errors on some of the search heads in the cluster. We wish to remove that search heads off the cluster as it has some host issues, is it safe to remove the hosts from the cluster if they have the following error. They started appearing recently after we stopped and started some of the instances in the cluster. Search peer has the following message: Local KV Store has replication issues. See introspection data and mongod.log for details. Local instance has state Recovering. And I am seeing this in the mongod.log 2019-03-15T23:27:57.682Z I QUERY [conn19] assertion 13436 not master or secondary; cannot currently read from this replSet member ns:s_AGAMOTK@Pm97x3TDpqncvhmiDI7wvs_kv_ldaulqcNjuQ4964Y7C9ZSc23KqZ.system.profile query:{ $query: { ts: { $gte: new Date(1552611510438) }, millis: { $gte: 1000 } }, $orderby: {} } I am seeing the same message in all the search heads which are having KV store errors. Please help to resolve this issue. Or is it okay to remove the members out of the cluster ? Thanks ... View more

Hi, I have found that there are a lot of knowledge objects in a particular app, which is a custom app and not a default Splunk app. And has some of the knowledge objects set to No owner . Whats does it exactly mean ?. Was it placed in the backend by someone instead of creating it through the UI ?? Thanks ... View more

Hi, We use the deployer to distribute configs to the search head cluster. I want to add configs to the search heads which are independent to each other. Can I place an app in the /etc/apps directory of each search head where as not causing any syncing issues with the deployer ? Thanks ... View more

Hi, We have an ongoing license with no errors. Recently, I have added one server to the license master, and the server previously had a lot of license violation errors, and as I have added it to the new license master, those error warnings got carried over. Is it necessary to take any action or will it cause any outage ? Message : This pool contains slave(s) with 29 warning(s) ... View more