The command you're looking for is eval. index=kafka-np sourcetype="KCON" connName="CCNGBU_*" ERROR=ERROR OR ERROR=WARN | eval StatusMsg = case(<<some expression>>, "Task threw an uncaught and unrecoverable exception", <<some other expression>>, "Ignoring await stop request for non-present connector", ..., <<a different expression>>, "Connection refused", 1==1, "Unknown") | table host connName StatusMsg  The trick is in selecting the appropriate status message.  You'll need to key off some field(s) in the results. ... View more

There is no option in tstats or values to limit the number of values.  You can, however, expand the host field and then limit the number displayed. | tstats values(host) as host where index=* by index | mvexpand host | dedup 5 index host   ... View more

Telnet will tell you if a network connection can be made, but won't say if the Splunk-to-Splunk protocol is working or not. Have you confirmed all forwarders are running?  Do they have the right outputs.conf settings?  Are their certificates valid? Have you looked at each forwarder's splunkd.log file to see what connection errors are being reported? Do you replace forwarders often?  If so, Splunk probably still expects to hear from the old ones and this message may be a false positive. ... View more

Have you checked splunkbase for an add-on for the product you are using? ... View more

What specifically do you plan to do to harden the server?  Once we know that, we can tell what effect it will have. ... View more

When the index becomes full, indexing will stop but DB Connect will continue to run.  Don't let the index get full. ... View more

That's a warning, not an error.  The file will be ingested, but while Splunk is busy with it other monitored files are ignored. Consider standing up a separate UF on that server just for the large files. Also, make sure maxKBps in limits.conf is set to 0 or the largest value the network can support. ... View more

This .conf24 presentation should have some useful information. GitHub - TheWoodRanger/presentation-conf_24_audittrail_native_telemetry ... View more

What does mongod.log say? What version of Splunk?  What version of KVStore?  Are you using mmapv1 or wiredTiger? ... View more

If data from the TA is not being indexed then ITSI cannot find it and display it. Why is the data not indexed? ... View more

Splunk cannot and  does not detect if data has already been indexed.  As @gcusello said,  it will attempt to avoid re-ingesting data, but that's not perfect. It's up to the app doing the ingestion to prevent reading the same data twice.  In DB Connect, for example, a "rising column" is defined to identify unique records.  Your app could do something similar, using case ID and Closed Time, perhaps. ... View more

Did you enable inputs in the TA? Is data from the TA being indexed? ... View more

All the settings you need are in the "Universal Forwarder" app on your cloud instance.  Open that app, click the green Download button, then install the downloaded file in the Universal Forwarder on your Windows server. ... View more

This can be achieved using props.conf.  Try these settings to start with [mysourcetype] ```The "Great Eight" settings``` SHOULD_LINEMERGE = false ```Break lines only between a line ending and a date (year)``` LINE_BREAKER = ([\r\n]+)\d{4} TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N MAX_TIMESTAMP_LOOKAHEAD = 30 TRUNCATE = 10000 ```Two settings for UFs``` EVENT_BREAKER_ENABLE = true EVENT_BREAKER = ([\r\n]+)\d{4} ... View more

What is your question?  Have you checked mongod.log and splunkd.log?  What did they say? ... View more

Easy-peasy index=_internal host=* component=Metrics name=thruput earliest=-24h | stats sum(total_k_processed) as "total data transfer" by host ```Convert KB to GB``` | eval "total data transfer" = 'total data transfer'/1024/1024 ... View more

Perhaps this will help index=_internal host=<<forwarder name>> component=Metrics name=thruput earliest=-24h | stats sum(total_k_processed) as "total data transfer" ... View more

I don't see why you cannot set repFactor in [default].  homePath also is listed as a per-index option, but I put it in the default stanza all the time (successfully). Try it and let us know how it works. ... View more

Where did you install the custom app?  It must be installed on the indexer(s) to create the index, but it must also be installed on the search head(s) for the index to appear in the GUI. ... View more

Open a case with Splunk Support. ... View more

The Splunkbase page for that app (you linked to it in your OP) will take you to the documentation.  Login to Splunkbase and the page will have a "Visit site" link. ... View more

Generally, speaking, Splunk processes events one at a time with no concept of "previous" or "next" events.  We can work around that using an aggregation command.  Try this <<your existing search>> ``` Check if the count for all sources of a transaction_id is zero``` | eventstats sum(count) as tx_count by transaction_id | eval Status=if(tx_count=0, "Missing in both sources", "Missing in source " + source) | stats values(Status) as Status by transaction_id ... View more

The dispatch endpoint launches a new search so that will not get what you're looking for.  Try the search/v2/jobs/export endpoint (https://docs.splunk.com/Documentation/Splunk/9.4.0/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2Fexport) ... View more

Documentation for props.conf is in props.conf.spec.  Documentation of props for Palo Alto is in the add-on.  I've attached props.conf from the TA for your reference. ... View more