Have you tried to map the "Name" to the "role" variable?  Have you checked the supported group information formats in the docs and verified it? Configure SAML SSO using configuration files on Splunk Enterprise - Splunk Documentation ... View more

Please share the screenshots and the search that you use to fill the summary index. ... View more

Please try to set "useRegexp: true" like below. It shouldnt be a wildcard problem. logsCollection: containers: multilineConfigs: - namespaceName: value: app1-dev podName: value: app1.* useRegexp: true containerName: value: app1 firstEntryRegex: ^(?P<EventTime>\d+\-\w+\-\d+\s+\d+:\d+:\d+\.\d+\s+\w+) - namespaceName: value: app2-* useRegexp: true podName: value: .* useRegexp: true containerName: value: .* useRegexp: true firstEntryRegex: /^\d{1}\.\d{1}\.\d{1}\.\d{1}\.\d{1}/|^[^\s].*   ... View more

You have to configure the webhook input as described in the shared dcos. Launch the Microsoft Teams Add-on for Splunk. Select Inputs > Create New Input > Teams Webhook. Have you done it? If not create the input first and then: The webhook address will be available via the internal ip on the instance where you've configured the webhook and you have to use the port that you've configured during the webhook setup.  curl <internal_ip_of_your_splunk_instance>:<the_configured_port> -d '{"value": "test"}' For an initial test you could execute the curl on the same instance where you've configured the webhook.  curl 127.0.0.1:<the_configured_port> -d '{"value": "test"}' To make the webhook address publicly accessible there are different ways of course as mentioned in the documentation The webhook must be a publicly accessible, HTTPS-secured endpoint that is addressable via a URL. You have two options to set up the Splunk instance running the Teams add-on. You can make it publicly accessible via HTTPS. Or you can use a load balancer, reverse proxy, tunnel, etc. in front of your Splunk instance running the add-on. The second option here can be preferable if you don't want to expose the Splunk heavy forwarder to the internet, as the public traffic terminates at that demarcation and then continues on internally to the Splunk heavy forwarder. ... View more

What is the output when you execute the curl command to test the webhook?  Have you nsured that the webhook is reachable from external? ... View more

Could you please try: transforms.conf [add_hostname] REGEX=.* FORMAT=host::$1 $0 SOURCE_KEY=MetaData:Host DEST_KEY=_raw       ... View more

The REST API gives you also globally shared searches back. You could try: 1.  filter out all searches with name="sharing">global< 2. filter for name="app">MYAPP< 3. use a different user to call the api   ... View more

Check out: Install on Linux - Splunk Documentation Start Splunk Enterprise for the first time - Splunk Documentation Configure Splunk Enterprise to start at boot time - Splunk Documentation ... View more

@winter4 wrote: thanks @PaulPanther  I am trying to add the uf host name to the raw event so trying to manipulate the raw event to have something like “HOSTNAME — _raw_events”    I am trying to configure this on the heavyforwarder and not trying to go into each uf to make configuration changes  Why would you do this? What is your usecase at the end? If you do it like this you have to touch every individual event. ... View more

Try to set  sendCookedData=false for the second HF output in your outputs.conf and then apply your props.conf on your second HF.    ... View more

Where to you wanna  exactly add the hostname of the uf? To the log event itself or do you wanna override the host metadata field?   Maybe following links could be helpful for you: Set host values based on event data - Splunk Documentation Set a default host for a file or directory input - Splunk Documentation   Feel free to share your configuration to double check it. ... View more

Ah okay, I'm pretty sure that this is not possible but maybe someone else has a solution for it. ... View more

On which splunk instance type do you face this issue? As a last option you could clean up the whole kvstore... ... View more

Have you tried to stop Splunk, removing the mongod.lock file and then start Splunk again? ... View more

Check out Embed scheduled reports - Splunk Documentation  You must save your dashboard searches as reports and then you enable embedding.   ... View more

Klick on your table in Dashboard Studio and choose Data display --> Header row --> Fixed ... View more

There exist some limits for the transaction command you can fnd them under Memory control options   transaction - Splunk Documentation More details to these limits can be found in transactions stanza in limits.conf - Splunk Documentation   ... View more

Okay. Could you check/verify if you use the Distributed Monitoring Console and if the affected HFs are configured as Indexer under Settings --> Monitoring Console --> Settings --> General Setup?  That could be the reason why the HeavyForwarder are configured as distributed search peers to monitor them in the DMC. So if the license manager on the same instance as the DMC is check the config files for the affected HFs and may remove them. ... View more

Okay, just to confirm master_uri and manager_uri is not set on the HF, right? Could you check what files are located under etc/licenses?  ... View more

That the knowledge bundle is replicated to the search peers is correct but for the parsing (e.g. timestamp extraction) during indexing only the configuration from $SPLUNK_HOME/etc/peer-apps is used as a source. So that's the reason why you must deploy the TA on the indexer if it is no HeavyForwarder inbetween. The knowledge bundle is used during the searching. https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Howindexingworks ... View more

You can do it easierwith following config: <format type="color" field="categoryId"> <colorPalette type="map">{"ACCESSORIES":#6DB7C6,"ARCADE":#F7BC38,"STRATEGY":#AFEEEE}</colorPalette> </format> https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/TableFormatsXML#Table_format_source_code_example  ... View more

Please check if your user has the edit_tokens_all capability assigned. The authentication extensions are configured and running without any issues? ... View more

Please remove parameter  master_uri = self  and try it again. If you get the same error please execute  splunk btool server list license --debug and share the output.  ... View more