Here are some things to try. Verify the CM is still running. Verify the CM is a search peer of the MC. Confirm there are no pending changes waiting to be applied in the MC. Confirm the MC is still allowed to connect to the CM (new firewall rule, perhaps). Check the MC's logs to see if reports any messages when trying to contact the CM. Restart the Splunk instance running the CM. Restart the Splunk instance running the MC. If you still can't figure it out, post a reply with more detail. ... View more

The first thing to do is have the Cluster Manager remove all excess buckets.  That leaves you with fewer to examine/back up. You may have noticed that some bucket names begin with "db_" and some begin with "rb_".  The former designates a primary bucket and the latter is for replica buckets.  So you might think you can just back up the db_* files and avoid duplicates.  Yes, you can, HOWEVER, if a primary bucket is lost one of the replicas will be made the new primary without changing the name.  That means skipping the rb_* files could keep a primary bucket from being backed up.   The likelihood of that happening depends on how often you back up the cluster and how often an indexer fails. To find the true primary buckets, ask the CM using this REST API call | rest /services/cluster/master/buckets search=has_primary=true Then use the output to drive the backups. ... View more

Splunk has a manual describing how to upgrade the Windows Universal Forwarder (UF).  See https://help.splunk.com/en/splunk-enterprise/forward-and-process-data/universal-forwarder-manual/9.4/upgrade-or-uninstall-the-universal-forwarder/upgrade-the-universal-forwarder ... View more

To get unsupported version of Splunk for interim upgrade steps, contact Splunk Support.  They can get it for you. ... View more

The Splunk Cloud service does not allow sending data outbound.  One can send alerts, reports, published dashboards, etc., but not raw events. ... View more

Deleting instance.cfg will not help with connectivity issues.  It will force the UF to generate a new GUID for itself and make it appear as a new UF to the DS.  The old GUID will show up as a "missing forwarder" in the Monitoring Console. ... View more

Linking an Azure-based database to Splunk is not much different from linking any other SQL database to Splunk.  This old answer should still be relevant.  If you still have problems getting it to work, reply with specific questions. ... View more

Submit a support request and ask for a Forwarder license. ... View more

1. A monitor input will do this.  Monitor a directory and the UF will detect new files in that directory.  Add ... to the path and it will detect new subdirectories where the ... is. 2. A monitor input will do this, too.  Monitor a file and the UF will detect when data is added to the file.  Note that Splunk is designed to read new text added to the end of a file.  Changes in the middle will likely go undetected. 3. Nothing in Splunk will do that.  A workaround is to run a modular input (Python or Java program) that monitors the desired file(s) and then converts them when updates are detected. ... View more

This probably should go in the Enterprise Security channel, but it looks like the drilldown search is using token $Host$, which doesn't exist.  Try $host$. ... View more

Splunk typically doesn't announce such things in advance.  We won't it until it happens. ... View more

I haven't done it myself, but it should be no different than making any other dataset CIM-compliant. Add fieldaliases, EVALs, and other KOs as necessary to define the CIM fields expected for the sourcetypes you use. ... View more

Have you tried restarting? ... View more

Have you checked the sidecar logs?  What do they say?  See https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.0/splunk-sidecars/sidecar-troubleshooting#ariaid-title2 for a list of sidecar log files. Try restarting all sidecars to see if that helps.  Find a list of sidecar processes at https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/splunk-sidecars/about-splunk-sidecars#list-of-sidecars-0.  Killing the supervisor process should automatically restart each sidecar. ... View more

The threshold for IOWait alerts defaults to too low a value.  Work with your system admins to determine the best value for your system. ... View more

What does "the token isn't translated correctly" mean?  How is it incorrect? Is the value of the correlationId field valid in a URL? ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

@livehybrid 's advice is good.  IMO, the hardest part of integrating Git with Splunk is keeping your users and admins from making changes in the Splunk UI.  Changes made in the UI override those made in apps so it's critical to make sure all changes go through Git. ... View more

Generally speaking, apps and add-ons by the same(-ish) name go together.  Installing one without the other most likely will lead to disappointment. Apps typically provide dashboards and other user interface objects, whereas add-ons provide the product integrations.  The docs for the Cisco Secure Access App does not mention this dependency so perhaps it's not the case here.  There are a couple of things you can check: Verify the app is able to connect to your Cisco Secure Access server.  See Make a Secure Access API Request Verify your data is where the app expects to find it.  See https://developer.cisco.com/docs/cloud-security/cisco-cloud-security-app-for-splunk/#splunk-indexes   ... View more

Try my revised regex.  It should extract the desired text, assuming there are no embedded spaces. ... View more

If the intent is to skip the word following "Process" then this should do it. description\": \"Process \S+ (?<uicgroup>[^\S]+) ... View more