Hi @anmolxmr  May i know which step or what error you got,.. more the details and more better the replies/answers will be, thanks.  ... View more

Hi @cipher  i am not much sure of this issue, but i thought to suggest you... for SplunkCloud, you could raise a Support ticket and you should receive good support from Splunk Support team. thanks.  ... View more

Hi @vr2312  >>>  just got hit by this issue at one of my customers on 10.X May i suggest you to create a new post with detailed info, so there will be fresh replies and solution(s) (many of the community members usually dont reply to such old posts), thanks.  ... View more

Hi @vr2312 thanks for bringing up the eleven years old topic back to life and some nice LOL reading moments 😉 ... View more

Hi @Kamachi  as this is a 2 years old topic, may i ask you, what steps you have performed so far, some more details like splunk cloud or onprim, etc ... View more

Hi @Kat7  May i know some more details pls: - is it ok to install Splunk agent on the PDQ Connect (i did google and found this - "PDQ Connect is a cloud-native, agent-based tool for managing remote and local devices. IT teams use it to deploy software, remediate vulnerabilities, and gain remote access — all without a VPN. It’s especially useful for hybrid and distributed workforces") --- if its ok to install Splunk agent, then, remaining tasks are simple and easy to do.  --- if its not ok to install Splunk agent, then, you already said, "I can manually export the PDQ logs from the web interface and upload them into Splunk" --- without installing Splunk agent, there may be other methods like HEC(http event collector), this requires some additional steps to configured ... View more

Hi @sjain  may i know Splunk Version 10 would be on Splunk Enterprise? or Splunk Cloud?   if you "urgently" looking for CommonValut Splunk App in Splunk V10: - get a Splunk V10 dev system, install the latest available CommonValut app,  - run some testing, load some sample data, check dashboards, reports, alerts, everything - confirm it and doublecheck everything before taking any decision about the production system Lets say "not-urgent", lets say a month time for upgrading to Splunk V10: - Contact the CommonValut dev guys - explain the issue in detailed manner - get their next update timeline and compare it with your timeline and take decision.  If this post or any post addressed your question, could you pls: Give it karma to show appreciation  Mark it as the solution if it solved your issue  Add a comment if you’d like more details  Acknowledging helpful answers will keep the community strong and motivates contributors to continue sharing their expertise, thanks.  ... View more

for current and future learners reference, i would like to post the Splunk's "Magic 8" https://kinneygroup.com/blog/splunk-magic-8-props-conf/   ... View more

For learners reference, i thought to post the Splunk doc link, thanks.  https://help.splunk.com/en/data-management/manage-splunk-enterprise-indexers/9.1/manage-the-indexer-cluster/perform-a-rolling-restart-of-an-indexer-cluster   ... View more

@shoaibalimir wrote:  >>> but we are kind of looking for implementing this on Splunk Cloud. Dear @shoaibalimir , Could you pls update us more details about "implmenting this on Splunk Cloud" Are you looking to implement the iframe on Splunk Cloud Classic Dashboard or Dashboard Studio or report / alert / emails, pls provide more details, thanks.  ... View more

Dear Splunkers,  as i thought to double check the add-on details, i got stuck up here: on the splunkbase, i see only 3 sailpoint apps/addons (image attached below) is the questioned add-on is an archived one?.. could you pls suggest how to get the splunkbase page for this above mentioned add-on, thanks     ... View more

Hi @cjharmening  Pls forgive my ignorance.. but,  POC meaning "Proof of Concept", POV means... is it "Proof of Value"? As suggested by @gcusello , pls follow those ideas, You will save lots of time("Valuable Time"). PS - this is mine - Karma Given 2217 Karma Received 490.. pls give me karma, thanks.    ... View more

Hi @samejgink  thanks for taking your time to update this feedback, much appreciated.  as @livehybrid suggested, the only way to get the Add-on updated would be thru the Add-on developers. Could you pls email the add-on dev guys (if no reply for you, pls update here as well. Someone from the community can reach out the sailpoint add-on team for you and everyone) hoping for faster resolution, thanks.  ... View more

Thanks @richgalloway @livehybrid .. appreciating your help with karma points. Selected @PickleRick 's reply as solution as it gives some more pointers and some more ideas. thanks again.  ... View more

  Thanks @PickleRick @livehybrid @richgalloway ..One more query   Let's assume two Splunk environments, both are having same SVC value. And one project runs with ingest pricing model whereas the other runs on workload pricing model. Now, as per your understanding, which one will be cheaper, the ingest model or the workload pricing model? ... View more

Hi @chenfan  Pls check this similar post: https://community.splunk.com/t5/Splunk-Search/How-do-I-apply-symbol-for-Y-axis-values-in-a-Splunk-Chart/m-p/400095   ... View more

Hi @livehybrid ,  >>> The upgrade docs above state you can go from 9.3.x to the latest 10.0.x version without needing to upgrade to 9.4.x first <<<    the above mentioned upgrade docs is for Splunk Enterprise i think(user is asking about UF, not Splunk Enterprise). and also i could not find where it says you can go from 9.3.x to latest 10.0.x, could you pls clarify, thanks.  ... View more

Hi @gitau_gm  First things first....1) what is the indexer version? Determining forwarder-indexer compatibility is important 2) only few UF's or high number of UF's? if only few, you can manually plan to upgrade. high number of UF's require more manual task or some automatic upgrades can be planned.   document for y(our) reference: https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-products-version-compatibility/compatibility-between-forwarders-and-splunk-enterprise-indexers Forwarder version Splunk Enterprise indexer version   9.2.x 9.3.x 9.4.x 10.0.x 8.1.x E, H, M E, H, M E, H, M E, H, M 8.2.x E, H, M E, H, M E, H, M E, H, M 9.0.x E, H, M E, H, M E, H, M E, H, M 9.1.x E, H, M E, H, M E, H, M E, H, M 9.2.x E, H, M E, H, M E, H, M E, H, M 9.3.x E, H, M E, H, M E, H, M E, H, M 9.4.x E, H, M E, H, M E, H, M E, H, M 10.0.x E, H, M E, H, M E, H, M E, H, M   E - Events. This version of forwarder can send event data to the corresponding version of indexer. H - HTTPOUT. This version of forwarder can send event data from Splunk instance to Splunk instance (S2S) over Hypertext Transfer Protocol Secure (HTTPS). M - Metrics. This version of forwarder can send both event data and metrics data to the corresponding version of indexer. ... View more

Hi @Sailesh6891  To list all Splunk indexes, use the search command 1)  | metadata type=indexes  2) | rest /services/data/indexes  3)  | tstats count where index=* by index 4)  with web UI access available(if you have admin access), check Settings > Indexes for a managed view.    for the question - creation time and who created the index there are no straight forward answer for this(should check about this).     Similar question discussed was: https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-get-a-list-of-available-indices/m-p/58945   ... View more

Hi @richgalloway @livehybrid @PrewinThomas .. all three of you gave the right answers. so, following the "first come first served" logic, selecting Rich's answer as the solution. given karma points for all 3, thanks.  for future users reference, pls check these 2 links for detailed info: https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.4/administer-the-app-key-value-store/back-up-and-restore-kv-store https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.0/administer-splunk-enterprise-with-the-command-line-interface-cli/administrative-cli-commands   ... View more

Hi @kamalKSharma  there are only these 3 ideas: 1) there is a "Splunk Enterprise Security Guided Product Tour" https://www.splunk.com/en_us/form/enterprise-security-tour.html 2) on youtube, there are few good Splunk ES demo videos available(they are from Splunk's own channel, so very good quality materials they are.) 3) as said by @PrewinThomas , splunkbase restricts "trial" downloads to customers who have purchased ES or have been provisioned a trial entitlement(by Splunk Sales team or Splunk Account mgr) ... View more