Deleting instance.cfg will not help with connectivity issues.  It will force the UF to generate a new GUID for itself and make it appear as a new UF to the DS.  The old GUID will show up as a "missing forwarder" in the Monitoring Console. ... View more

Linking an Azure-based database to Splunk is not much different from linking any other SQL database to Splunk.  This old answer should still be relevant.  If you still have problems getting it to work, reply with specific questions. ... View more

Submit a support request and ask for a Forwarder license. ... View more

1. A monitor input will do this.  Monitor a directory and the UF will detect new files in that directory.  Add ... to the path and it will detect new subdirectories where the ... is. 2. A monitor input will do this, too.  Monitor a file and the UF will detect when data is added to the file.  Note that Splunk is designed to read new text added to the end of a file.  Changes in the middle will likely go undetected. 3. Nothing in Splunk will do that.  A workaround is to run a modular input (Python or Java program) that monitors the desired file(s) and then converts them when updates are detected. ... View more

This probably should go in the Enterprise Security channel, but it looks like the drilldown search is using token $Host$, which doesn't exist.  Try $host$. ... View more

Splunk typically doesn't announce such things in advance.  We won't it until it happens. ... View more

I haven't done it myself, but it should be no different than making any other dataset CIM-compliant. Add fieldaliases, EVALs, and other KOs as necessary to define the CIM fields expected for the sourcetypes you use. ... View more

Have you tried restarting? ... View more

Have you checked the sidecar logs?  What do they say?  See https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.0/splunk-sidecars/sidecar-troubleshooting#ariaid-title2 for a list of sidecar log files. Try restarting all sidecars to see if that helps.  Find a list of sidecar processes at https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/splunk-sidecars/about-splunk-sidecars#list-of-sidecars-0.  Killing the supervisor process should automatically restart each sidecar. ... View more

The threshold for IOWait alerts defaults to too low a value.  Work with your system admins to determine the best value for your system. ... View more

What does "the token isn't translated correctly" mean?  How is it incorrect? Is the value of the correlationId field valid in a URL? ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

@livehybrid 's advice is good.  IMO, the hardest part of integrating Git with Splunk is keeping your users and admins from making changes in the Splunk UI.  Changes made in the UI override those made in apps so it's critical to make sure all changes go through Git. ... View more

Generally speaking, apps and add-ons by the same(-ish) name go together.  Installing one without the other most likely will lead to disappointment. Apps typically provide dashboards and other user interface objects, whereas add-ons provide the product integrations.  The docs for the Cisco Secure Access App does not mention this dependency so perhaps it's not the case here.  There are a couple of things you can check: Verify the app is able to connect to your Cisco Secure Access server.  See Make a Secure Access API Request Verify your data is where the app expects to find it.  See https://developer.cisco.com/docs/cloud-security/cisco-cloud-security-app-for-splunk/#splunk-indexes   ... View more

Try my revised regex.  It should extract the desired text, assuming there are no embedded spaces. ... View more

If the intent is to skip the word following "Process" then this should do it. description\": \"Process \S+ (?<uicgroup>[^\S]+) ... View more

I've never heard of active-active as a Splunk-recommended architecture for Deployment Servers.  DS Clusters is the support architecture for DS redundancy. ... View more

ODS is correct - active-active is not a thing for deployment servers.  If you need DS redundancy, consider creating a Deployment Server Cluster.  See https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.4/configure-the-deployment-system/implement-a-deployment-server-cluster for details. ... View more

The splunkbase page for that app says to contact the developers at [email protected] ... View more

Depending on the size of the lookup file, the map command may do the job. | inputlookup id.csv | eval search_start=strptime(time,) | map search="index=id ID_index=$ID$ starttime>$search_start$ timeformat=\"%m.%d.%Y\" | stats count as cnt by $ID$ | where cnt>$limit$ | | eval msg="limit outreached" | table $ID$ cnt $limit$" ... View more

When the query ends with stats count, it will always return one result.  Therefore,  Number of Results > 0 will always trigger the alert.  Add a where command to the alert so it only returns results if there are consecutive errors. index=your_logs "error" | bin _time span=1m | stats count as error_count by _time | streamstats window=2 current=t count(error_count) as consecutive_error_minutes | where consecutive_error_minutes >= 2 | stats count as alert_trigger | where alert_trigger > 0 That said, I have doubts about the methodology used.  The current query will trigger if two consecutive errors are detected, but what if they're different errors?  Does it matter?  I would think that two different errors would not be considered "persistence". ... View more

Have you tried this filter? JournalFilter = NOT MESSAGE~"apparmor=ALLOW" If that doesn't work then you can use props and transforms or Ingest Actions to drop the unwanted events in HF or indexer.  Props and transforms work only in the first full instance (HF or indexer) that the data passes through; Ingest Actions work in any full instance. ... View more