Usually, a search is skipped because of external factors (no resources), but a search will be skipped if it contains an error or if it's already/still running.  The Monitoring Console or CMC will tell the reason for the skips in the Scheduler Activity dashboard.  Fix the reason and the skips should stop. ... View more

This site implies the remote.s3.endpoint setting is not needed.  https://blog.arcusdata.io/how-to-set-up-splunk-smart-store-in-aws See https://docs.splunk.com/Documentation/Splunk/9.3.0/Indexer/SmartStoresecuritystrategies#Authenticate_with_the_remote_storage_service for AWS permissions that must be granted to the role. ... View more

Change RF/SF to 1 and the CM will not complain about missing nodes. ... View more

Yes, removing an app from the server class will cause the client to uninstall that app. ... View more

Splunk has good write-ups on this at https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_with_TLS and https://docs.splunk.com/Documentation/Splunk/9.3.1/Security/AboutsecuringyourSplunkconfigurationwithSSL   ... View more

Individual sourcetypes cannot be deleted.  Data is deleted by the bucket, which is a subset of an index.  When a bucket is deleted, all events in that bucket are removed from the system. The delete command does not delete data.  It merely hides it from view. There is no backend command to delete data. If you are fortunate, the undesired sourcetypes are the only ones in their respective indexes.  In that case you can set the frozenTimePeriodInSecs for the index(es) to 1 and wait for Splunk to delete the buckets in the index(es). If you are like most sites and have a mixture of sourcetypes in your indexes then it becomes more of a challenge.  One option: Copy the sourcetypes you wish to keep into a different index using the collect command.  This will impact your ingestion license. Set frozenTimePeriodInSecs on the original index to 1 and wait for buckets to be deleted.  This will delete everything in the index.  On-prem environments can use the clean CLI command to delete the index. Revert the frozenTimePeriodInSecs setting. Use the collect command to copy the desired data back to the original index.  This avoids having to change the queries that use that index name and will impact your ingestion license (again).  In an on-prem environment, you can rename the index to the original name. See https://docs.splunk.com/Documentation/Splunk/9.3.0/Indexer/RemovedatafromSplunk#Remove_all_data_from_one_or_all_indexes for more information. ... View more

Splunk recommendation is to NOT send syslog data directly (or via a LB) to a Splunk instance.  Syslog should be sent to a dedicated syslog server (running syslog-ng or rsyslog) and then forwarded to Splunk.  The syslog servers should be positioned as close to the data source as possible to avoid data loss.  Use of a load balancer in front of the syslog servers is recommended for resiliency. For more information, see https://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkEnterprisehandlessyslogdata#Caveats_to_using_Splunk_Enterprise_as_a_syslog_server_or_message_sender https://www.splunk.com/en_us/blog/tips-and-tricks/high-performance-syslogging-for-splunk-using-syslog-ng-part-1.html   ... View more

Where are you seeing that?  In what context? Splunk doesn't process audio.  Please tell us more about the use case and the issue. ... View more

LINE_BREAKER does not extract timestamps.  That's what TIME_FORMAT does. There seems to be two issues here: Lines not breaking correctly when the date is a single digit. Timestamps not extracted correctly when the date is a single digit. There's a separate setting for each. The line breaker is telling Splunk the next event must have a two-digit year so that is what Splunk does.  To make the date 1 or 2 digits, modify the regex: ([\r\n])\[\w{3}\s\w{3}\s\d{1,2}\s\d{2}:\d{2}: or keep it simple with ([\r\n])\[\w{3}\s\w{3} The latter regex has the advantage of handling any time zone. The %d formatting variable accepts both one- and two-digit dates.  I believe the problem with the formatting string is the extra space after "%d". Here's the final set of props.     [sql:logs] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n])\[\w{3}\s\w{3}\s\d{1,2}\s\d{2}:\d{2}:\d{2}\s\w{3}\s\d{4}\] TIME_PREFIX=\{ TIME_FORMAT=%a %b %d %H:%M:%S %Z %Y         ... View more

We can't help you fix what's wrong without knowing what is wrong.  "Red health" could be caused by any of many things (or multiple things).  Click on the read health icon to show the health status and then click on each red icon to get details about what is wrong (or what Splunk thinks is wrong - sometimes it's wrong about that).  Pass on that information and someone should be able to help you fix it. ... View more

Just about every Splunk query contains a pipe so I question the accuracy of the post you quoted. My theory (and I can't find any documentation to support it) is the collect command does not return the field being throttled so the alert cannot be throttled.  The collect command is used to write results to an index and is used to populate summaries more than it is to trigger alerts.  I suggest having two searches - one to populate testindex and other other to read testindex and trigger the alert. ... View more

The first error is in using an indexer as a UDP receiver.  That likely will result in data loss.  Recommended practice for the last several years is to send syslog events to a dedicated syslog receiver, such as syslog-ng or rsyslog.  Then use a Universal Forwarder to send the events from the syslog server to Splunk. The current LINE_BREAKER setting says an event doesn't end until it finds a newline so the incoming text is held until that condition is met.  This can be overridden in file inputs, but not with UDP (another case for using a syslog server).  Try this line breaker and also add TIME_FORMAT. LINE_BREAKER = ([\r\n]+).*$ TIME_FORMAT = %b %d %H:%M:%S.%3N   ... View more

Sometimes you can right-drag and then opt to copy without formatting.  If not, copy the field name and use Ctrl-Shift-V to paste it without the HTML. ... View more

It's not clear what is meant by "partial search" and how Splunk is to know a search returned partial results or just fewer results. The subsearch idea likely won't work because subsearches execute before the main search and so would be unable to detect errors in the main search. There is the require command that will abort a query if there are zero results.  That may not meet your requirements, however. ... View more

From Splunk's perspective, no action is needed to stop using the software.  Your company, however, may have its own requirements, such as archiving the data before decommissioning the server. ... View more

Splunkbase automatically archives apps that have not been updated in 24 months.  That does not mean the app no longer works or cannot be used.  However, as noted on the cited page, this app has been replaced by another. The functionality of this add-on has been incorporated into the supported Splunk Add-on for Microsoft Office 365 https://splunkbase.splunk.com/app/4055 ... View more

It depends on what is meant by "decommissioning Splunk".  There is a process for removing a member from a search head or indexer cluster.  Decommissioning an independent indexer typically would mean moving that indexer's data to another indexer. If you will not be running Splunk anywhere then just stop Splunk and retire the server. ... View more

What is your role?  The indexes you can see are based on your role. Can you share the exact error message(s) so are seeing along with the query that caused?  That will help us find the source of the problem. ... View more

Remove "authorisationheader" from the URL.  That's not a valid HEC URL. If that doesn't help, then please post the exact text of the error message(s) you see and also identify the "it" that tells you the URL is incorrect. ... View more

All tokens in a search must have a non-null value before the search will run. Try setting the null tokens to empty strings ("") before the search. ... View more

A local account is one that does not use SAML or LDAP for authentication.  It's the default if you have not configured SSO. The account you log onto the Splunk console with may not be available on all instances.  The account is know to the search heads, but not to indexers or universal forwarders and probably not to heavy forwarders.  Each could have had an admin account created when Splunk was installed.  If it was not created or if you don't have the password, reset the account using the instructions at https://community.splunk.com/t5/Security/How-to-Reset-the-Admin-password/m-p/10622 ... View more