About richgalloway

richgalloway · ‎05-11-2026

SPL files are just renamed tgz files. There's no need to do anything. Just install the file as-is.

richgalloway · ‎05-08-2026

Have you tried cloning the XML dashboard to Dashboard Studio? Splunk will do the conversion for you.

richgalloway · ‎05-08-2026

The best way to get clarification on a Documentation page is to submit feedback on the page. Click the "Share feedback" button at the bottom of the page.

richgalloway · ‎05-05-2026

We need more information. Are not getting any logs or just some of them? If some, are you getting the internal logs for the forwarder that is supposed to be sending them? Please share the inputs.conf stanza for the missing logs.

richgalloway · ‎05-01-2026

Splunk 10.0.x is not the latest version. Try 10.2.x.

richgalloway · ‎04-30-2026

Questions like this should be directed to someone at Cribl.

richgalloway · ‎04-29-2026

Splunk has not supported SSL 2.0 or 3.0 for some time now. It only supports TLS 1.0, 1.1, and 1.2 with 1.2 being the recommended version. I'm curious about how Tenable was able to connect using an unsupported protocol. Splunk 9.1.x is no longer supported so no fixes are forthcoming for that version. A supported version may contain a fix, but it's hard to know without a CVE number. You may find mention of a fix at http://advisory.splunk.com

richgalloway · ‎04-29-2026

Yes, the upgrader has to run as root to do its work, but the end result should be the UF running as the specified non-root user. If that is not happening then it's a problem that should be reported using one of the methods previously mentioned.

richgalloway · ‎04-28-2026

If you can't submit a case then submit it as an RFE at https://ideas.splunk.com

richgalloway · ‎04-28-2026

I suggest you submit a case to Splunk Support. The upgrader should not assume the UF runs as root. Running as root is a Bad Practice.

richgalloway · ‎04-24-2026

Why assume when you can get the right answer from the manual? 😀 [WinEventLog://ChangeRequestWebService]

richgalloway · ‎04-24-2026

It would help to know the errors seen in the UI, but if the DS cannot search the _ds* indexes then the UI will not function properly. Add the relevant (probably custom) TA to the DS so it knows how to search the indexers. The MC should already have distributed search configuration. The CM does not need it and won't care if it's present.

richgalloway · ‎04-22-2026

Use the splunk offline --enforce-counts command to take down each indexer one at a time. Splunk will handle moving data as necessary. Make sure the RF/SF is met and all indexes are searchable before moving on to the next indexer.

richgalloway · ‎04-21-2026

It looks like you researched it well. I like your plan. Yes, you will need an on-prem DS to manage your UFs unless you have a separate tool (like Ansible) for that. Replacing Cribl with Edge Processor is worth looking into as it may save you some money. EP cannot yet do everything Cribl can, however. I agree with putting EP nodes close to the data sources. I have not used EP for syslog so I can't comment on that. I found SC4S to be a good syslog solution, but it's been a few years since I've used it.

richgalloway · ‎04-20-2026

Perhaps this article will help. Also, you can get agent info from any SH by searching the _ds_* indexes.

richgalloway · ‎04-15-2026

We don't know what customizations Splunk may have made to postgres. Installing code from another source may introduce incompatibilities. Code not released by Splunk may not be supported by Splunk. Changing delivered files may trigger File Integrity Check warnings.

richgalloway · ‎04-13-2026

After configuring SAML, did you map group names to Splunk roles? Does your Identity Provider contain group names for each user that will have access to Splunk? Without both of those, Splunk has no way to know what permissions to grant the user.

richgalloway · ‎04-13-2026

Check https://advisory.splunk.com and install the version of Splunk that fixes that vulnerability. Do NOT attempt to patch postgres independently.

richgalloway · ‎04-13-2026

Mandate

richgalloway · ‎04-08-2026

Creating a scripted or modular input is difficult without some programming knowledge, but AI should be able to help. I understand Claude is good at programming. Splunk Support is for break/fix issues, not scripting. Splunk ODS can offer advice, but cannot create a script for you. Splunk Professional Services, however, can create it. Whether you choose a scripted or modular input, adding checkpointing is a good idea to protect against interruptions in the input.

richgalloway · ‎04-08-2026

See https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.2/get-other-kinds-of-data-in/get-data-from-apis-and-other-remote-data-interfaces-through-scripted-inputs or https://help.splunk.com/en/splunk-enterprise/developing-views-and-apps-for-splunk-web/9.4/modular-inputs/create-modular-inputs

richgalloway · ‎04-06-2026

I made an assumption about what field contains the 200 values. Please change "status" throughout to the correct field name for your data. Also, try changing "sum" to "count".

richgalloway · ‎04-06-2026

It would help you know what you've tried so far and how those attempts failed you. I would use something like the following: <your query for relevant events> | stats count as requests, sum(eval(status=200)) as success by cs_uri_stem | eval pct=success*100/requests | table cs_uri_stem requests pct

richgalloway · ‎04-03-2026

Check the props.conf settings for the sourcetype ingested by the inputs.conf entry. Chances are the time parsing settings are incorrect. Verify the TIME_FORMAT and TIME_PREFIX settings in particular. You may need to add a TZ setting.

richgalloway · ‎04-03-2026

Consider adding indexes to the SH. SPL2 may be another instance of app functionality that needs it.

Posts	16782
Solutions	2989
Karma Given	2028
Karma Received	6725
Member Since	‎07-24-2012

Online Status	Online
Date Last Visited	an hour ago

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: Downloaded as SPL and not as tgz

Re: heatmap viz in Splunk 10.2.2

Re: Regarding rex in SPL2 supports raw string lite...

Re: Logs not ingested into Indexer

Re: postgres update

Re: Are there any restrictions on the free Cribl l...

Re: SSL vulnerabilities

Re: Why does the Splunk Upgrader for Linux 1.0.3 a...

Re: Why does the Splunk Upgrader for Linux 1.0.3 a...

Re: Why does the Splunk Upgrader for Linux 1.0.3 a...

Re: Correct syntax for new WinEventLog Entry

Re: Deployment Server | Clustered environment 10.2...

Re: What are the steps to decommission half of the...

Re: Splunk Hybrid Cloud Architecture

Re: Agent management page is not loading

Re: postgres update

Re: Splunk UI Login Issue via SAML SSO – Assistanc...

Re: postgres update

Re: Add Enterprise Security to on prem clustered e...

Re: Python script deployment to pull logs

Re: Python script deployment to pull logs

Re: How to get percent of http 200 codes per file

Re: How to get percent of http 200 codes per file

Re: Correcting ingesting timestamp for Solarwinds ...

Re: SPL2 can access only a subset of available ind...

Join the Conversation