@darrenWhat does the splunkd.log show after the UF has crashed? ... View more

@darren  Check this https://community.splunk.com/t5/Splunk-Enterprise/URGENT-All-splunk-forwarders-upgraded-to-10-0-version-are/td-p/751274  Disabled the evt_resolve_ad_obj = 0 in Splunk_TA_windows app , logs have now ceased. ... View more

@ww9rivers  Some users have resolved this by switching to Firefox or disabling problematic Chrome extensions (like ad blockers or privacy tools) that interfere with Splunk Web's JSON handling ... View more

@Priya70   It sounds like the UF might be hitting a resource bottleneck (CPU, memory, disk I/O, or handles) or the Windows Event Log channels may be overwhelmed. If the UF is forwarding to an indexer, intermittent network issues could also create backpressure and stall inputs. I recommend checking $SPLUNK_HOME/var/log/splunk/splunkd.log for any warnings/errors around the time the data stops, this usually gives good clues on whether it’s resource, input, or connectivity related. ... View more

@sushilkarCould you please run the following command and share the output? /opt/splunk/bin/splunk show kvstore-status --verbose  Also, have you recently upgraded Splunk? If yes, please specify the version you upgraded from and the version you upgraded to. ... View more

@srek3502  Don’t put a load balancer in front of two search head deployers. An SHC is designed to have one deployer per cluster, and members should point conf_deploy_fetch_url at that single deployer. Running multiple active deployers (even behind a VIP) is unsupported and risks conflicting bundles. https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/update-search-head-cluster-members/use-the-deployer-to-distribute-apps-and-configuration-updates   Each search head cluster needs one deployer, which lives outside the cluster and distributes bundles. If high availability is critical: Use tools like Ansible or scripts to switch to a standby deployer and update conf_deploy_fetch_url if needed. ... View more

@srek3502  You can use a single deployer for multiple SHCs only if all clusters have identical apps and configurations and share the same secret. ... View more

@Dolly  Refer the below link.  Solved: Postgresql on Splunk Enterprise - Splunk Community ... View more

@Namo  If Splunk is sending emails from a domain that lacks proper authentication (SPF, DKIM, DMARC), email providers may flag it as spam. Check this internally with your IT team.  Ensure the sending domain is properly configured: SPF: Add Splunk’s sending IP to your domain’s SPF record. DKIM: Sign outgoing emails with DKIM if possible. DMARC: Set up a DMARC policy to monitor and enforce authentication ... View more

@Namo Check this https://community.splunk.com/t5/Splunk-Search/how-to-send-Splunk-email-alert-to-inbox-not-junk-mailbox/m-p/412030    ... View more

@acambridge It' s a Developer Supported app Please contact https://www.qmulos.com/contact-us/  ... View more

@elend check this https://community.splunk.com/t5/Getting-Data-In/Reducing-maxWarmDBCount-below-current-warm-bucket-count/m-p/86115  ... View more

@elend  Refer this screenshot.    ... View more

@elend  Splunk bucket transitions from Hot → Warm → Cold → Frozen are controlled by multiple parameters: maxHotBuckets, maxDataSize or homePath.maxDataSizeMB, maxHotSpanSecs maxWarmDBCount Simply reducing maxWarmDBCount may not trigger a bucket roll if other thresholds, such as time or size haven’t been met. For instance, warm buckets will remain as-is if they haven't exceeded the defined size or time limits. ... View more

@nopera  I recommend installing the add-on on both the indexers and the search heads. Indexers are responsible for index-time operations such as parsing, data transformation, and routing. Therefore, any add-on containing props.conf or transforms.conf should be deployed to the indexers. Search Heads handle search-time functions, including dashboards, lookups, macros, and CIM mappings. While it's safe to install the add-on on the search heads for search-time functionality, doing so won’t interfere with index-time processes, provided those configurations are also present on the indexers. In general, it's best practice to install the add-on across all relevant tiers, indexers, search heads, and forwarders, and enable only the necessary components on each, depending on the role of the system. https://docs.splunk.com/Documentation/AddOns/released/Overview/Wheretoinstall  ... View more

@Showkat_CT  Splunk SOAR Cloud is a managed SaaS offering, you need a Splunk subscription or trial with SOAR enabled. You'll receive a dedicated SOAR Cloud instance and login credentials from Splunk. If you haven’t yet, reach out to your Splunk account team or open a support case to get your Cloud environment provisioned. https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/introduction-to-splunk-soar-cloud/administer-splunk-soar-cloud?utm_source=chatgpt.com  You'll receive a URL (like: https://<your-org>.soar.splunkcloud.com) plus a default admin email and temporary password. https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/introduction-to-splunk-soar-cloud/take-a-tour-of-splunk-soar-cloud-and-perform-product-onboarding-when-you-log-in-for-the-first-time?utm_source=chatgpt.com  ... View more

@nopera Install the add-on in the /opt/splunk/etc/apps directory on the HF. If you're using a deployment server and plan to deploy the add-on to a heavy forwarder (HF), place the add-on in the /opt/splunk/etc/deployment-apps directory on the deployment server. Then, create a server class, add the HF to that server class, associate the app with it, and deploy it to the HF. ... View more

@nopera  The props.conf configuration is specific to the sourcetype MSExchange:2013:MessageTracking. Please ensure that the corresponding add-on is installed on your heavy forwarder to enable proper parsing of the data.  [MSExchange:2013:MessageTracking] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false REPORT-fields = msexchange2013msgtrack-fields, msgtrack-extract-psender, msgtrack-psender, msgtrack-sender, msgtrack-recipients, msgtrack-recipient TRANSFORMS-comments = ignore-comments FIELDALIAS-server_hostname_as_dest = server_hostname AS dest FIELDALIAS-host_as_dvc = host AS dvc EVAL-src=coalesce(original_client_ip,cs_ip) EVAL-product = "Exchange" EVAL-vendor = "Microsoft" EVAL-sender = coalesce(PurportedSender,sender) EVAL-src_user = coalesce(PurportedSender,sender) EVAL-sender_username = coalesce(psender_username,sender_username) EVAL-sender_domain = coalesce(psender_domain,sender_domain) LOOKUP-event_id_to_action = event_id_to_action_lookup event_id OUTPUT action TIME_PREFIX = ^\d\d MAX_TIMESTAMP_LOOKAHEAD = 24 TIME_FORMAT = %y-%m-%dT%H:%M:%S.%QZ    ... View more

@nopera  You have to install this add-on https://splunkbase.splunk.com/app/3225 and match the exact sourcetype for the parsing.  Example:  [monitor://C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking] whitelist=\.log$|\.LOG$ time_before_close = 0 sourcetype=MSExchange:2013:MessageTracking queue=parsingQueue index=msexchange disabled=false   ... View more

@tsocyberoperati  Has this forwarder ever successfully onboarded Windows Security events into Splunk in the past?     ... View more

@bt149      ... View more

@siv  Dashboard Studio does not support custom visualizations (like Network Diagram Viz from Splunkbase). These visualizations are only supported in Classic (Simple XML) dashboards. If you want to stay in Dashboard Studio, use the built-in Link Graph like this     ... View more

@laura  It looks like this app isn’t restricted by region, organization type, or license level but rather by explicit download permissions set by the developer itself.  The developer of the app has decided to make the app restricted, so only approved users can download it. ... View more