FYI: With 9.4 or something there is nasty feature which shows only GUIDs etc. in default field. Fortunately there is setting link/button on headers from where you can select "missing" fields. Unfortunately this is not a permanent settings, so you must do it again and again 😞 ... View more

If you have access to use rest you can try this |rest /services/server/info|transpose Other option is that you ask that your admin create report which you can run "as report owner" authority and it will give that information to you. Base search could be previous SPL and then just add needed fields as output table.  ... View more

Hi I think that your issue is this "|first_seen=". Splunk use this as a regex and | has special purpose on those. You could try this [<Your sourcetype name here>] SHOULD_LINEMERGE=false LINE_BREAKER=([\n\r]+)\| first_seen= TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3Q%Z TIME_PREFIX=\| first_seen= MAX_TIMESTAMP_LOOKAHEAD=30 This works at least 10.2.0 beta. r. Ismo  ... View more

This is really interesting. How it works if there is indexed field which can contains also space? Or did it add as " mark in those indexed fields? Or didn't it work anyhow? ... View more

It's exactly like @PickleRick said. Splunk didn't offer any official method to do this kind of deduplication. Then best option is install UF into this nfs server and use it as collecting those.  Then depending what your actually environment is (there are several possibilities which come into my mind) there could be some other ways to manage it. ... View more

One more comment about the configuration to connect your indexers or DS. Depending on how you install your configurations on those systems you must have almost always some configuration package to install with first time binary installation. In minimum this is package (splunk app) that contains information and needed certs to connect to Your Splunk Indexers. This apply if you are installing your collection apps via GPO, Ansible, manually or some other configuration tool. If you are using DS (deployment server) to deliver app configuration then you must install also DS client package into those UFs. Then just us DS as normally is used to deliver other packages. In that way you can see immediately, after UFs has installed and configured to configure your system, internal logs from those new UF. If/when you have configure some alerts for unknown logs then you can react and continue with onboarding process as planned.   ... View more

Please accept that answer as Solution, so later other users can see it. ... View more

If you have configured SHC correctly (send all logs to indexers and no local indexes) then you already have it in place. If not then fix your SHC configuration.  ... View more

This sounds like @richgalloway said. You have defined some other KOs like field extraction inline or transforms. Maybe eventtypes and/or macros which are private or if those are public, other user’s role hasn’t permissions to see and use those.  ... View more

As @PickleRick said, it’s just data. Still there could be issues as (if I remember right) it was from version 7.x? After that there have been some changes in splunk internals, but I suppose that it will still works? Or you find out quite soon if not.  Then those used add ons are different story. You could find newer versions for quite many, but probably not for all. Without correctly “onboarded” data it will be harder to find those answers, but not impossible. You have also option to run bots in bots.splunk.com for training purpose. ... View more

That's true. Then you must remember that rebalancing just count number of buckets when it does its work. Because buckets can have different sizes the disk space usage is not rebalanced just count of those. In rebalancing there are two options: rebalance primaries rebalance buckets 1st one is done automatically in quite many situations e.g. rolling restart etc. 2nd one is always manual work which target it set to 90% level. What I have done by myself is modify that %-level. Depending on environment I have used e.g. 95-99% to get better distribution of buckets over nodes. After you have gotten suitable level, you should adjust that % level back to 90%. ... View more

If you do a restart for your test license and check are those internal logs before restart usable and there is no error in internals then it should work. Also you could use that testing like in https://community.splunk.com/t5/Knowledge-Management/SmartStore-How-to-verify-splunk-indexer-connectivty-to-remote/m-p/399606 and it works then it works. There are more examples on help.splunk.com for test it. ... View more

I'm not sure it this is valid response or not? But when I look license file I couldn't found any feature for S2 in enterprise license. Unfortunately I haven't any demo/test node which I can switch to free license to test it and check how that license file changes. But I think that It could be possible that it's working with free version too. Best option is if you could test it with trial license and minio as S3 backend. If it works then it should work also with GCP environment. Of course it's better if you could test this also in GCP too. There is no mention of S2 as restricted/removed features in https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.4/configure-splunk-licenses/about-splunk-free If/when you have tested this, please inform us, is it working or not! ... View more

If I recall right there could be only one defaultGroup at time. It's not mater if it is under tcpout or syslog stanza, splunk use same for both. So if you want all goes to Splunk then use defaultGroup only in tcpout stanza and when you need to route some events into syslog use transforms with _SYSLOG_ROUTING. You should also remember that when you have configured more than one output targets which are used for same event, then if any of those stopped to receive events then all those stopped to work sooner or later. See more e.g. blockOnCloning etc. ... View more

If possible before you start you should backup whole splunk installation including SPLUNK_DB as there is no any supported rollback method! You should remember first stop splunk then full backup of it installation and then continue. And remember that you should have all those splunk versions including oldest to do a full restore if needed. You probably have some/many additional apps in your installations? Probably some of those have also interactions how to upgrade those version by version. You must check this and also try to get those needed versions. Unfortunately that could be quite hard task to do as many apps have only latest or couple of latest versions in splunkbase and also instructions are probably missing! So most important thing is make great plan how to proceed. One option (especially if you don't need old data) is start from scratch. Just install needed apps etc. into a new and start to get data in. Of course if you need old data regularly then this is not an option for you. ... View more

When you found answer, please add it here. So other can get it too when they have a same issue. Here is link to time modifier section on help.splunk.com https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/specify-time-ranges/specify-time-modifiers-in-your-search   ... View more

Or your last change index has named differently. You should check it from e.g. with btool on command line or use Admin little helper from splunkbase if you are in Splunk Cloud. ... View more

Here is excellent conf presentation how to find why queue is full. https://conf.splunk.com/files/2019/slides/FN1570.pdf ... View more

I doubt it. As far as I know, downloading is restricted to person who has generated the NFR license in portal. ... View more

Normally download right is a person who have generate and download NFR license in partner portal. If it was you and it didn’t work, you should contact partnerverse email or your contact at splunk. ... View more

As said the reason why those aren’t logged anymore into internals, is how GET and POST methods works. You can read more e.g. from https://www.w3schools.com/tags/ref_httpmethods.asp ... View more

On left side “interesting fields” with verbose search mode, did you have field name ResponsePayload or @ResponsePayload on it? If there are then you could try to use something like  |spath input=ResponsePayload to get it as a json. But this needs that content of this field is real json format without errors! Basically you could take content of this field and test it with jq or some other tool to ensure it. If you haven’t this field extracted then again check that this is real json and also that it’s content doesn’t have any additional characters in source which breaks json format. I have seen e.g. that “ mark has replaced \u0022 which means that those are strings not jsons. ... View more

Have you registered this app in Entra side? Without that it cannot access EntraId. There are instructions in this manual how you should troubleshoot it. Just follow those instructions and tell to us if there are anything in internal logs where you need our help! ... View more

What you are meaning with “optional upgrade”? I think that most new versions are somehow optional. If those are not fixing any big problems which are preventing the use of current version then it’s somehow optional. Even it presents a new features it still optional if one doesn’t need those? Of course currently one must update their apps regularly or otherwise those are archived in splunkbase. But even these cases one needs to update e.g. splunk SDK on those. Is that upgrade mandatory or optional it’s up to your opinion. ... View more

Also the best practice is not to use timestamp field as a checkpoint column. There are many reasons for this. With high volume db this field can contains several rows with same value. Also converting checkpoint values between different data types is not a good practice. The best option is use enough big serial as a checkpoint field. You also must have index for that field. ... View more