Have you been able to access? We are still having this problem and cannot access entitlements nor open cases. Splunk seems not to be aware of this problem at all after contacting them. ... View more

Can you try to add SSL CA Chain to below location and see if it works?   1) /opt/splunk/lib/python3.7/site-packages/certifi And 2) /etc/apps/<Add-on_folder>/lib/certify   ... View more

Hello @ITGSOC  , Yes you can migrate a Splunk Enterprise server from a virtual machine (VM) to a physical server. Before starting the migration, make sure to take a complete backup of your Splunk data, configurations, and any custom settings. Ensure that the physical server meets the hardware requirements for running Splunk and that the operating system is compatible with the version of Splunk you're using.  ransfer your configuration files and data from the virtual machine to the physical server. This typically includes files in the etc directory within your Splunk installation ($SPLUNK_HOME/etc). Be sure to copy over apps and any custom configurations.    Refer this  :https://community.splunk.com/t5/Deployment-Architecture/What-is-the-process-to-move-an-infrastructure-from-virtual/m-p/110175  ... View more

Thank you @kiran_panchavat for your response. However, this may not be useful as we can not install Splunk inside the container. We are not monitoring the container itself or the docker logs. The logs that needs to be monitored are from some applications installed inside the container. As mentioned we have around 5-6 containters. ... View more

Another remarks. You shouldn't ever install any additional module directly into Splunk's python! If there is something what you are needing, then create on app (see dev.splunk.com) and add those libraries under it. ... View more

Is there another source that explains in detail how the settings are made in OPENCTI AND SPLUNK? ... View more

This seems to fix the rest endpoint issue (esp. changes to outputs.conf). https://docs.splunk.com/Documentation/Splunk/latest/Updating/Upgradepre-9.2deploymentservers ... View more

I created a dvwa application and used SplunkUniversalForwarder to forward the log to port 9997, containing events such as sql injection and brute force cracking, but incident_review and ess_security_posture is not hitting any event ... View more

Hi @Pratyush, yes, Azure team has assigned a user to the groups they have created, and we have mapped that group with Splunk ... View more

Yah, I have discussion with Sale Prepresentative in local Vietnam and they said we dont need to pay more if we want to create new instance for our Private cloud because we purchased license type with capacity/day. ... View more

you have whitespaces in your query: try to use:  <base_query....>      search="*action*view*User_Management_Hourra*"     OR <base_query....>      search="*action*view*Hourra*"   best regards, P.S. another question: do you have admin permissions and can access the _internal index ? index=_internal sourcetype=splunkd earliest=-1m ... View more

If you're using PowerConnect you'll need to get a license. It's not free software. You'll install the software into your Netweaver layer using SAINT. Then, you have to exchange a HEC token with your Splunk instance. There is some additional config on the SAP side to establish the connection with Splunk. ... View more

@Sumi - First of all, please explain onto why are you looking for pid file?? ... View more

Thank you Kiran. What I am looking for is the meaning of each component code found. For instance If I run -  index=_* | stats count by component index log_level I see many component codes with Warning or Error. The question becomes what does that component code mean and if there is a warning or error what is the action needed to correct or tune? I do not see any documentation in Splunk to that effect and have asked Splunk PS, Splunk Instructors and Splunk Support. No answer yet. I want to build dashboards and associated alerts to help me know the stability and status of the platform. Thank you! ... View more

Ok. Back up a little. You have a file. It's supposed to be a certificate (possibly with a certificate chain from trusted rootCA). How did you get it? Did you send someone a CSR to obtain a cert? Did you just get a cert because you mailed/called/faxed/whatever someone and told them "hey, we need a cert"? And the most important question here is - do you have a private key corresponding to that cert? ... View more

@tlmayesSorry for the misunderstanding, it is an unsupported add-on.       ... View more

@danielbb  Warm and cold buckets can be copied safely while Splunk is running. You don’t necessarily need to stop Splunk to perform the cold data migration.  Refer the below link:  https://community.splunk.com/t5/Deployment-Architecture/How-to-migrate-data-of-cold-and-thawed-path-to-different/m-p/580124  ... View more

@fabrizioalleva  Connecting Splunk DB Connect to an on-premises MongoDB instance requires some additional steps compared to using MongoDB Atlas. To connect to your on-premises MongoDB, you’ll need the MongoDB JDBC driver. You can download it from https://unityjdbc.com/download.php?type=mongodb  . Make sure to obtain the mongodb_unityjdbc_full.jar from the installation folder. Then, you can configure a JDBC Connection https://unityjdbc.com/mongojdbc/setup/mongodb_jdbc_splunk_dbconnect_v3.pdf  I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.   ... View more

@danielmtz Check the below links for more information.  https://community.splunk.com/t5/Splunk-Dev/Developer-License-request-form-not-working/m-p/669697  I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks. ... View more

@abhi04 Hello Abhi, Please use the below regex.  Does my answer above solve your question? If yes, spare a moment to accept the answer and vote for it. Thanks. ... View more

Use this index=testing | timechart max("event.Properties.duration") as maxDuration | eval maxDuration=round(maxDuration/1000, 3)   ... View more