We have used F5 in front of our syslog servers, but as said you must know how to configure F5 to use e.g. correct profile. Otherwise you will definitely lost events. Our load was couple of billion event per day and in your tests with correctly configured F5 we don’t lost any events. With incorrectly conf we lost lot. ... View more

As already said it depends. Are you parsing events on indexers or some HFs makes difference for your indexers amount if you have lot of sourcetypes.  If I recall right there is/was mentions in docs that you shouldn’t put too many different sourcetypes in one index. But what is “too many”? Obviously that hasn’t defined 😞 Then if/when you are using e.g. CIM and acceleration that probably use more resources if you have more indexes and sourcetypes (I haven’t measured it, just IMHO). When you have lot of sourcetypes those are evaluated in each search as you could see from search.log. There are nice blog post about this issue by Martin Muller https://www.consist.de/de/unternehmen/blog/artikel/Splunk-Effiziente-Normalisierung-fuer-das-Common-Information-Model-CIM/# Probably something else too, but as other already said I haven’t ever seen this kind of official instructions for that. ... View more

You should try this. There are lot of other limits like TRUNCATE etc which could also hit, especially in some other issues. I really suggest that you should read those spec files and additionally limits.conf is one useful ... View more

Basically that kind of information. It’s quite standard json based audit log. ... View more

Based on that this is shared to everyone with write permission you should have those accesses. Is this on prem or SCP environment? Based on listed roles I’m expecting on prem. Is there been any updates or other changes in your environment? What are your versions, os etc? any other issues in your environment? And have you any errors on internal logs after you have tried to save it? ... View more

don’t use map if it’s the only choose an you haven’t enough small dataset. With any real/bigger datasets this is not a winning story 😞 As usual it depends. If you are not limited to tight time schedule I like to do 1st summary or kvstore depends on case as a schedule search. Then after couple or hours or whatever is your safe timeframe do the real searches against that temporary data. You can do that even closer from original search as currently splunk have command https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.2/search-commands/require which you can use to check that earlier phase has successfully finished. Of course you need some “magic” to tell it. ... View more

As @livehybrid a said it depends on your needs but as you said it’s enough copying buckets to another place then try to keep it KISS and use coldToFrozenDir.  But if you realize that you need to do something else than just move buckets from one plac3 to another then you are needing script version. Of course then you need to write that script by yourself if you cannot fin suitable from somewhere. ... View more

Are you talking about on prem instances or splunk cloud? ... View more

So it’s same issue that I have already mentioned for 7.3 cases. Let’s see when splunk can fix it. If you have enough information you could raise a ticket into support and have a lot of funny time whit them 😉 ... View more

Have you found any common baseline for those failing servers? Like DC or other special purpose servers? Are there any local host based FW or network shares or disks in use? Anything what is different than those servers where install has succeeded? ... View more

Are you installing this with admininstrator right or just with your own? ... View more

This is not a LM issue as you can see on your log, it just said that it cannot send event to indexers! How you have configured your UF's (I expecting that we are talking those) outputs.conf? Are there indexer discovery in use or just IPs of those indexers in site1 and how about site2's indexers? Is this multisite cluster with 2 site all indexers active or is this some kind of HA setup where you have identical configuration on site1 and site2 and then you somehow do switch over when need?   ... View more

How about that FlashArray storage? Is it shared with those applications which are generated that traffic peaks? And are all indexers using this same array? How it is connected to indexers and other nodes which are using it? Could it be also "network" congestion between it and other nodes? ... View more

Have you updated those JDBC app packages also? ... View more

I'm using this https://splunkbase.splunk.com/app/7371 with my SCP 10.2. I'm not sure if it collects exactly same set of logs or not. ... View more

In SPL yes, with SPL2 there is option (see my other answer). ... View more

And probably AWS based, not GCP either Azure? And your storage is only DDAA or also DDSS? ... View more

I'm expecting that you have Intel Mac not M-series version? If you have M-series, then there is currently only UF version for it. Earlier there was beta for M series, but it has ended by 1.4. and at least I haven't have heard anything new after it. So currently only option to run splunk on M-series is run it under docker with correct emulation (works at least with splunk 9.x). I haven't tried this yet for 10.x as I have run that beta until now. For some unknown reason your hostname seems to be ethernet mac address? You can check it with command ifconfig en0 (or it your primary interface is something else use it). You have two options. Change you host name on OS level to something reasonable  Set it in Splunk's config file server.conf serverName = WhatEverYouWant inputs.conf host = WhatEverYouWant ... View more

This should work when you update your transforms.conf to [rewrite_sourcetype_wmc] REGEX= EVENTTYPEKEY="([^\"]+)" FORMAT=sourcetype::$1 DEST_KEY=MetaData:Sourcetype Be sure that this is in 1st full splunk instance from source! In props.conf you should have [wmc_events] ... TIME_PREFIX = ^TIMESTAMP=" ... TRANSFORMS-assignSourcetype = rewrite_sourcetype_wmc  Are you sure that you are needing CHARSET and TZ here? Those are usually needed on source node where your inputs.conf  is. Also NO_BINARY_CHECK should be in source system. ... View more

Probably only thing that you can try is to get more IOPS for your indexers disks. I have seen cases where this phase has taken even hours due to too slow disks and lot of cold buckets. ... View more

Please link your app here in splunk base or GitHub. It's much easier to help if we can be sure which app we are talking about! Usually you should contact to App's developer and ask from him/her what is situation and are there any plans to update it. If not then depending on app you can try to continue to use it, fix/modify it by yourself or find another app which fulfills your needs. ... View more

As already said, you cannot use two REGEX in one stanza. If you have this kind of need you probably need do use INGEST_EVAL where you can use several SPL eval and based on those set then sourcetype=xyz from previous phases. Can you give some example events to us? ... View more

As other already said, I'm not sure what you are looking for. Maybe this helps you https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/9.4/introduction/endpoints-reference-list and look here .../scheduled/views and other under it? ... View more

Basically that should work. I'm not remember in which label you can do it? At least in some like panel's label it works but I'm not sure if it works for page/dashboard label? But maybe you can put something into Label and then add html + h1 tags where you add this information? ... View more