Is the client set to restart itself when it downloads the app? ... View more

You should be able to search for the dashboard name(s) in the _audit index. ... View more

Adding intermediate forwarders introduces complexity and improves neither integrity nor latency.  Loss of one of the HFs means half of the UFs are off-line. The HFs need time to process events so that adds latency. ... View more

Inputs settings can determine which files to monitor, but cannot filter events out of monitored files.  To do that, you need to use props and (optionally) transforms on an indexer or heavy forwarder. ... View more

It's not necessary to uninstall a universal forwarder before upgrading it.  Just run the installer and it will perform the steps needed for the upgrade. ... View more

Verify your network allows connections *out* to your Splunk Cloud stack's port 8089. ... View more

There are many reasons why a transform might not work.  The most common is the regular expression doesn't match the incoming data.  It's also possible the source name doesn't match what's in props.conf so the transform is never invoked. ... View more

Yes, you can run the reload deploy-server command and should install the props and transforms on the forwarders (if done correctly).  It will not install them on indexers or search heads. ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

Splunk can get confused by the dot operator as it can separate parts of a field name, components of a JSON field, or represent concatenation.  To help eliminate the confusion try renaming fields to name that do not contain dots or put single quotes around the field names. ... View more

Put the props and transforms on the indexers and search heads.  If the forwarders are heavy forwarders then they go there, too. What is the "Master Deployment"?  That's not a Splunk term. ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

The regex does not match the sample event.  It will only work for events from the host "CN-SH-PSG-01".  To match any host name, try this regex: "(?:[\w-]+)"\s+(?<bytes_in>\d+)\s+(?<client_ip>\d+\.\d+\.\d+\.\d+)\s+(?<status_code>\d+)\s+(?<action>[^\s]+)\s+(?<bytes_out>\d+)\s+(?<bytes_out2>[^\s]+)\s+(?<http_method>[^\s]+)\s+(?<protocol>[^\s]+)\s+(?<domain>[^\s]+)\s+(?<port>\d+)\s+[^\s]+\s+(?<user>[^\s]+)\s+[^\s]+\s+[^\s]+\s+(?<mime_type>[^\s]+)\s+[^\s]+\s+"(?<user_agent>[^"]+)" Notice I removed the meaningless "^.*" from the beginning.  That is implied in all regular expressions without the ^ anchor. The FORMAT setting must be on a separate line, but I presume that's a copy-paste error. Changes to transforms require a restart of the indexer and apply only to new events. Make sure the source name associated with the data is exactly "syslog".   If it doesn't, try using the sourcetype name. ... View more

Certificates are not accessible through the GUI.  You'll need to find someone with CLI access or fix the problem in the app and re-install it. ... View more

| eventstats dc(field1) as dc_field1 | stats dc(field2) as dc_field2, max(dc_field1) by field1 ... View more

The default (trial) Splunk license expires after 60 days so would not have a 2038 expiration date. The free license, which is what the trial license becomes after the trial ends, has a 2038 expiration date, but also has a number of limitations, including preventing an instance from functioning as a heavy forwarder or deployment server.  Also, the Settings->Licensing screen should clearly say "Free license". Again, your Splunk account team is your best source of answers about your licenses. ... View more

Probably not, but I'm not sure what you mean by "license duplication problems".  An LM will store only one copy of a license. ... View more

What do you mean by "services"? You can see what apps are installed by selecting "Manage apps" from the Apps menu. It's not clear what you want to know about what you are ingesting.  The inputs themselves probably are defined on your on-prem forwarders so are not visible from Splunk Cloud.  Of course, the actual data ingested is visible in the indexes. ... View more

Contact your Splunk account team for information about your Splunk Cloud license.   They also can help ensure you have entitlement to submit support cases. If you're running heavy forwarders and a DS then you have an on-prem LM (perhaps shared with the DS).  However, I would not expect the expiration date of that license to match the expiration date of the Splunk Cloud license (it's possible, but not guaranteed). ... View more

Yes, copying data from one index to another, in the same or different indexer, will consume license (except for sourcetype=stash). That said, I would expect you to use 600GB of license so the extra 200GB came from somewhere else, probably unexpected data sources. Use the Monitoring Console to show license usage over time to see when the increase started.  Then split the results by source or sourcetype to see which is responsible for the increase. ... View more

I can't say I've seen that form used in the wild. ... View more

The CSV file needs to have a header row that labels the fields in the file ("Date", "Field2", "Field3", etc.).  Then a query can use the lookup command to find a specific value in the CSV file and return the matching fields. ... | lookup dummy.csv Date ``` Returns all fields by default ``` One limiting factor is lookups are exact matches.  The Date field would need to include the day of the week to match the CSV file.  You can set up a lookup definition (Settings->Lookups->Lookup definitions) that references the dummy.csv file, but also allows wildcard searching of the lookup table.  Go to the Advanced options, and put "WILDCARD(Date)" in the "Match type" box.  Then, it's a matter of putting wildcards ('*') in the CSV file's Date field in place of the day name.   ... View more

I see another syntax error.  The map command expects its search string to be in quotation marks rather than as a subsearch.  The $earliest$ form doesn't work in subsearches (except in a dashboard).   index=event sourcetype=eventdat | where like(details,"...")) | eval earliest=strftime(floor(_time), "%m/%d/%Y:%H:%M:%S"), latest=strftime(ceil(_time+2), "%m/%d/%Y:%H:%M:%S") | table _time details earliest latest | map maxsearches=10 search = "index=sys_stats sourcetype=statdat device="..." earliest=$earliest$ latest=$latest$ | stats count as counter | eval details=$details$, earliest=\"$earliest$\", latest=\"$latest$\" | table _time details counter earliest latest"     ... View more