@NickNguyen Refer the below document.  Resource Usage: CPU Usage - Splunk Documentation  Solved: Example of how to measure server CPU usage? - Splunk Community *** If the above solution helps, an upvote is appreciated. *** ... View more

@keneyfofe Have you checked splunkd.log? Check the below link for reference.  https://community.splunk.com/t5/Splunk-Enterprise/SplunkUI-app-list-error-V9-1-0-1-SVA-S1-lab-instance/m-p/651872  If this helps, please upvote or accept solution.  ... View more

@jppasnak  Splunk team confirmed that is a bug on Splunk version 9.2.x. The Splunk Dev team is working on that. We can wait until they release fix version.    You should create a support/bug ticket to Splunk Support. ** If this helps, please upvote or accept solution. ** ... View more

@chanathipRefer the below link. How to integrate Splunk with SAP HANA? - Splunk Community     ... View more

@sumarri    Kindly check the below documents for reference https://docs.splunk.com/Documentation/Splunk/9.2.1/Search/SavingandsharingjobsinSplunkWeb https://docs.splunk.com/Documentation/Splunk/latest/Security/Aboutusersandroles ... View more

@abhi_2985you can refer to the below documents. Splunk Web Interface SSL Certificates – Microsoft AD CA (yaleman.org) How do I configure an SSL cert for Splunk Web on a... - Splunk Community ... View more

@Mohd_Harahsheh9 Please find below the Tenable and Splunk integration documents.  Tenable and Splunk Integration Guide  Troubleshooting (tenable.com) Tenable Data in Splunk Dashboard  --- If this reply helps you, Karma would be appreciated. ... View more

@SCruz Follow the below document and go through your requirement to install the add-on or app in Splunk Cloud.  Install an add-on in Splunk Cloud Platform - Splunk Documentation  --- If this reply helps you, Karma would be appreciated. ... View more

@abhi04  @abhi04 Hello Abhi, To on-board the logs you have to use Splunk Add-ons not Apps. They handle tasks related to data ingestion, parsing, extraction etc. Splunk-certified or written TAs (technology add-ons) adhere to the Common Information Model (CIM) and are often used for data parsing. An app in Splunk provides a front-end interface for visualizing data. It’s like a user-friendly dashboard that allows you to explore and analyze information. If this reply helps you, Karma would be appreciated. !!!  ... View more

@pm2012Try this. We can do it in multiple ways.           ... View more

@sahityasweety  Check the Job Inspector. In the Inspector popup window, there is another link to the search.log that gives you some very detailed information. Another way to see more info about your errors is to open a plain search window and do a search like: index=_internal error Review your search query to ensure it is correctly formulated. Check for any typos, missing keywords, or syntax errors. Verify that the time range specified in your search covers the relevant data. Ensure that you are searching within the appropriate indexes. Check the Splunk logs (such as splunkd.log and search.log) for any errors or warnings related to your search. https://lantern.splunk.com/Splunk_Platform/Product_Tips/Searching_and_Reporting/Troubleshooting_and_investigating_searches https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Search/ViewsearchjobpropertieswiththeJobInspector If this reply helps you, Karma would be appreciated. ... View more

@abhi_2985  The openssl commands needed for the conversion are straightforward to use. Start by opening your terminal and navigating to the directory with your CRT file. Here’s how to convert .crt to .pem: openssl x509 -in certificate.crt -out certificate.pem -outform PEM Replace ‘certificate.crt’ with your .crt file name and ‘certificate.pem’ with your desired .pem file name. This command will convert your .crt to .pem, providing you with a new file in .pem format. ... View more

@Moshe Hey, Please find the below documents for your reference  The Splunk ODBC Driver - Splunk Documentation Configure the Splunk ODBC driver with Microsoft Power BI - Splunk Documentation  using-the-splunk-odbc-driver-tech-brief.pdf  ... View more

@Splunk-Star  The user configuration known as "selected fields" is located in $SPLUNK_HOME/splunk/etc/users//user-prefs/local/ui-prefs.conf and is modifiable by interface. Users can change the default user-prefs.conf file that you set. The choice is fields = ["host","source","sourcetype"] in display.events.fields https://docs.splunk.com/Documentation/Splunk/latest/Admin/Ui-prefsconf#Display_Formatting_Options  ... View more

@architkhanna  If it is possible, provide inputs.conf and outputs.conf from the source side(UF). Maybe your log files are rotating and splunk is detecting the copy as a new log file to index. please check if : you are using the crcSalt option. If you are using "crcSalt=<SOURCE>" with rotated logs, this could also cause duplicates. This happens because the rotated file may stay in the same directory with a different name. check the rotation of your files, if no first lines are modified during the process. symlinks, verify that the multiple symlinks are not pointing to the same file/folder ... View more

@architkhanna Can you confirm how your inputs.conf and outputs.conf is configured? ... View more

@architkhanna Hello, can you please go through this link Solved: Why are there many duplicate events in the indexer... - Splunk Community ... View more

@HemanthCR7   Hi Hemanth, It depends on your organization sometimes to encounter this problem when attempting to register using your corporate email. because external emails may be blocked by certain businesses. Should that be the case, open a support ticket and examine your spam folder. ... View more

@smitbelani Please have a look Notification when a new update is released - Splunk Community  ... View more

@rickymckenzie10 I think that you should read at https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Indexesconf https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf  frozenTimePeriodInSecs = <nonnegative integer> * The number of seconds after which indexed data rolls to frozen. * If you do not specify a 'coldToFrozenScript', data is deleted when rolled to frozen. * NOTE: Every event in a bucket must be older than 'frozenTimePeriodInSecs' seconds before the bucket rolls to frozen. * The highest legal value is 4294967295. * Default: 188697600 (6 years) maxTotalDataSizeMB = <nonnegative integer> * The maximum size of an index, in megabytes. * If an index grows larger than the maximum size, splunkd freezes the oldest data in the index. * This setting applies only to hot, warm, and cold buckets. It does not apply to thawed buckets. * CAUTION: The 'maxTotalDataSizeMB' size limit can be reached before the time limit defined in 'frozenTimePeriodInSecs' due to the way bucket time spans are calculated. When the 'maxTotalDataSizeMB' limit is reached, the buckets are rolled to frozen. As the default policy for frozen data is deletion, unintended data loss could occur. * Splunkd ignores this setting on remote storage enabled indexes. * Highest legal value is 4294967295 * Default: 500000   ... View more