Hi @alexspunkshell , Using the Monitoring Console, are you able to see what searches are being skipped?  The most common reasons for Skipped Searches and  Delayed Searches are usually having too many searches scheduled at the same time.   Here's an article that might assist you better: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Cloud_Platform/Reducing_skipped_searches_in_Splunk_Cloud_Platform ... View more

From the Splunk page for Previous Releases : If you require a version that is not listed please contact Splunk Support.   https://www.splunk.com/en_us/download/previous-releases/universalforwarder.html   You will need to contact Splunk Support to find a version that suits your use case.       ... View more

Try this search |tstats values(sourcetype) as Sourcetype latest(_time) as Time groupby index,sourcetype|fields - Sourcetype | convert ctime(Time)  It will give you a table of the last day an event was received by index & sourcetype. ... View more

Take a look at the Monitoring Console to see what searches are being delayed and why. Go to Monitoring Console -> Search -> Scheduler Activity: Instance and take a look at the "Count of Skipped Reports by Name and Reason" It could be there are multiple searches running at the same time.    What type of server is having this error? Is it a normal Search Head or is it a Search Head running correlational searches (Ex: Enterprise Security)?   ... View more

Try this regex to match ccjbh  \w+$   ... View more

Could you try editing alert_actions.conf to include the correct Python version?     python.version = {default|python|python2|python3} * For Python scripts only, selects which Python version to use. * Set to either "default" or "python" to use the system-wide default Python version. * Optional. * Default: Not set; uses the system-wide Python version.     https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Alertactionsconf ... View more

@sherkhan6ad6oy  Are there any messages in the splunkd.log that suggests that the script was not able to be ran?  ... View more

I'm not familiar with using winscp all that much. I typically use putty and pscp. If it's a software installed by your IT department then it's possible they have some features disabled. I use pscp to transfer files to my server as my user account and then "sudo chown" the files to the splunk user, the same process that isoutamo mentioned.     ... View more

Are you able to login to WinSCP using a non-splunk account and then tell WinSCP to use sudo on login?  https://winscp.net/eng/docs/faq_su#use_sudo_on_login (Example) In the WinSCP login options window: Click Advanced options Go to Environment --> SCP/Shell (on left) Select Shell: "sudo su - splunk" ... View more

Did it work before upgrading?  Could you confirm that the user you are logged into the SH has the "admin_all_objects" capability.   In the Health Check page, if you click on any of the failed items, can you click on the magnifying glass to "open the search" in a new tab? Does that give an error as well? ... View more

@mello920  Just to confirm, you are able to run regular searches outside of the Monitoring Console?  Do the other dashboards inside of the Monitoring Console work?   There isn't a way to just 'reinstall' the Monitoring Console by itself. You would have to reinstall Splunk Enterprise. ... View more

After installing the app did you check the permissions of the app? You might have to change it to global so that you can utilize the visualizations outside of the app.  ... View more

And that's the only inputs.conf located on your UF? Splunk-regmon is trying to be ran from some configuration. Were you actively monitoring the registry before this error started to pop up?   Take a look at this article: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowsregistrydata The inputs.conf file contains the specific regular expressions you create to refine and filter the Registry hive paths you want the Splunk platform to monitor.   It could be that the app is looking at the wrong inputs.conf and getting confused.  Try running this command to look through all of your inputs.confs D:\SplunkUniversalForwarder\bin\splunk.exe btool inputs list > ..\btool.txt It will create a txt file for you to go through.     ... View more

That's correct. 🙂 ... View more

Do you have any REGEX in your inputs.conf ? That's where I would look first. ... View more

Hi @tkerr1357  Try this search and see if it produces the data you're looking for.   index=wineventlog OR index=fortigate [| inputlookup TORIP |rename "TORIP" as "src_ip" |return 999 "src_ip"] ... View more

I don't think the versions being different would cause an issue like that. In our environment our Splunk servers are on 8.2.5 and some forwarders are still reporting using version 7.0.x    Do your forwarders show up in the Monitoring Console?  There is a dashboard available under the Forwarders drop-down. It will report if they're actively reporting data to Splunk or if they're "missing"   ... View more

What is the name of the Correlational Search that is having this issue? If you are sure that the index and sourcetype has the data it requires, is it possible that you are missing a Technical Addon that maps the data into a CIM format? ... View more

The clients should not have to be re-added. You're saying that the Search Head is also the Deployment Master? I.E. in Forwarder Management you can see the apps and Server Classes that typically get pushed out to the forwarders?    Were they showing up before you upgraded Splunk? What versions of Splunk Forwarders were installed on the Windows/Linux boxes?   Are you receiving any errors in /opt/splunk/var/log/splunkd.log? ... View more

In your first search,  index=very_big_index caseNumber=1234567799 | table _time Name caseNumber UID phone   Is phone blank because the value should be "phone_number"?   Does this search not return your results?  index=very_big_index caseNumber=1234567799 | table _time Name caseNumber UID phone_number     ... View more