Hi @uona  there is a misunderstanding here: When we onboard / upload zip file manually, the splunk will give: "Preview is not supported for this archive file, but it can still be indexed." but this original post is about something else (monitoring a zip file). may i know if you face some issues while uploading a zip file?, if yes, could you pls open a new post and lets discuss there.  ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of May 2026, my Karma Given is 2312 and my Karma Received is 497, lets revamp the Karma Culture! Thanks and best regards, Sekar -------------------------------------------------------------------------------------------- ... View more

Hi @RAVISHANKAR  Could you pls provide more details: 1) Splunk OnPrim or Splunk Cloud 2) from where are you reading the file? on UF or HF or...  windows or linux? 3) was the file getting indexed properly before? or is this the first time you face this issue? 4) is there any changes, upgrades, anything happened 5) Pls provide the inputs.conf for that particular file   ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of May 2026, my Karma Given is 2312 and my Karma Received is 497, lets revamp the Karma Culture! Thanks and best regards, Sekar -------------------------------------------------------------------------------------------- ... View more

Hi @kvm  Could you pls check https://www.splunk.com/en_us/blog/tips-and-tricks/getting-data-from-your-rest-apis-into-splunk.html   ... View more

Hi @kvm  I did some search for ASMS inside the splunkbase, but no matches and google also does not help much.  In general, App integration to Splunk via API typically follows one of two methods: 1)Push method (sending/pushing data into Splunk) 2)Pull method (pulling/extracting data from Splunk) May we know which one you like to use, so we can suggest that method.  ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of May 2026, my Karma Given is 2312 and my Karma Received is 497, lets revamp the Karma Culture! Thanks and best regards, Sekar -------------------------------------------------------------------------------------------- ... View more

my bad, missed that, thanks @livehybrid  ... View more

Hi @zapping575  May i know if you tried like this: sourcetype=your_source_type | transaction host startswith="to FAIL" endswith="from FAIL" maxspan=30s  for doc reference: https://help.splunk.com/en/splunk-enterprise/spl-search-reference/10.2/search-commands/transaction   ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of May 2026, my Karma Given is 2312 and my Karma Received is 497, lets revamp the Karma Culture! Thanks and best regards, Sekar -------------------------------------------------------------------------------------------- ... View more

for learners reference: https://help.splunk.com/en/splunk-cloud-platform/search/splunk-ai-assistant/1.3.2/install-and-configure-splunk-ai-assistant-for-spl/activate-splunk-ai-assistant-for-spl-through-cloud-connected   ... View more

Hi @thang4  i am not much sure how to help you. but still let me suggest 2 things:  1) may i know if you copied the activation code correctly?(after copy pasting the code, by mistake, did you enter a space button?) 2) if activation code is copied right and if still gives an error, then, you have to contact the [email protected] only ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of May 2026, my Karma Given is 2312 and my Karma Received is 497, lets revamp the Karma Culture! Thanks and best regards, Sekar -------------------------------------------------------------------------------------------- ... View more

Hi @LovingSplunk  i felt your initial query was bit confusing.  from your line: >>> does anybody have a free license Cribl implementation in conjunction with Splunk, that actually works?  now i feel, your question is: can i use 1 TB Free Cribl and 5TB Splunk together? Yes i think you can use this combination. Thanks.    ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

ok sure @andrew_lander  >>> was wondering if there is a safe way to upgrade without crashing the PC.  as per my little knowledge, UF installation wont crash the PC   now coming the UF installation task this is just a trial and error idea, if i am in your position i would do this one: there are only 2 methods: old to new or new to old as suggested on previous reply, (the 6.4.x will install fine), so lets start with 7x, try installing it and see if it installs fine. if installed fine, then upgrade next version, then next.. OR just start with the latest UF agent, try installing it. it will mostly fail i think. then go down one version lower, try repeat the same and you will find a version which installs fine.    ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

Ok Sure @anissabnk  Next, lets check what props and transforms are being applied. Could you pls try: splunk btool props list <sourcetype> --debug splunk btool transforms list <transform_name> --debug ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar -------------------------------------------------------------------------------------------- ... View more

Hi @Pooja1 may i ask few more details pls 1) are you using the "Tenable Add-On for Splunk", if yes, the version number pls https://splunkbase.splunk.com/app/4060 2) are you using the Splunk Enterprise Security, if yes, the version number pls 3) may we know if there are any plans for Splunk upgrade in near future? 4) the above mentioned vulnerability, may we know where do you see this exactly? between 2 regular app hosts or on the Splunk system itself.. ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

Hi @andrew_lander  may i know if you use Splunk Enterprise OnPrim or Splunk Cloud and the version number pls. The last version with support for Windows 7 was 6.4.11. However, the forwarder is no longer supported, the forwarder may contain vulnerabilities, and the forwarder may not communicate with supported versions of Splunk Enterprise OnPrim or Splunk Cloud. (found this from - https://community.splunk.com/t5/Splunk-Enterprise/Need-download-link-for-Legacy-Splunk-Universal-Forwarder/m-p/748905 ) ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

Hi @Sherminator ,  1) the EventGen is a great tool but Super Poorly documented one. I have struggled with that multiple times and all went to failures.  i would suggest you, give it a try, if it takes hours and hours, stop there, check the other options 2) the other option.. the security content-->data_sources is a good one(i would suggest try this one first, than the EventGen) for example: https://github.com/splunk/security_content/blob/develop/data_sources/windows_event_log_security_1100.yml got an example_log at the lower side of that page.  Pls provide us some more details: 1) OnPrim or Splunk Cloud 2) using HF or not 3) Test Triggering Events, from Windows hosts or Linux hosts, etc.. ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

Hi @anissabnk  may i know, after updating @livehybrid 's props and transforms, did you restart the Splunk Service     ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ----------------------------------------------------------------------------------------------   ... View more

Hi @anmolxmr  may i know if you checked: `openssl verify` command for certificates involved   also there is a discussion about this issue on the Splunk Slack Channel, could you pls check: https://splunkcommunity.slack.com/archives/CDE623ETD/p1776776953119089     ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

@wp-uk-36thanks for the topic, there are some superb and healthy discussions.  my another my 2-cent suggestion: create a thread in Splunk Slack, there are Splunk employees and Splunk Dev guys there and they can give more insights Never Stop Learning! ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ----------------------------------------------------------------------------------------------   ... View more

Hi @wp-uk-36 this is a good idea, and as suggested in previous reply, pls create an idea. now the challenging part is, getting good upvotes for your idea, so that Splunk Dev team will look into this.  Pls check my idea about Splunk Search bar - User Experience Design https://ideas.splunk.com/ideas/EID-I-1312 once you created your idea, pls do some promotion and marketing, so it will get enough votes. thanks  ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: >>> Give it karma / upvote to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ----------------------------------------------------------------------------------------------   ... View more

Hi @anmolxmr  The KnowBe4 side refuses to accept the Auth token value, raising a support case with KnowBe4 support (https://support.knowbe4.com/hc/en-us/requests/new) seems to be the better way to fix this. also, the guide seems to be misleading. They set the auth to Bearer Token, and add the Splunk token there - which makes no sense to me. That will add a header called Authorization  with value Bearer yourHECtoken . Then under custom headers, they add the same header again, but with the (proper) value of Splunk yourHECtoken . I would for sure set Auth to None, and see if that helps, thanks.  ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

Hi @harris  Could you pls provide more details: 1) Splunk OnPrim or Splunk Cloud 2) was this working fine previously 3) any recent changes, upgrades to the DBConnect or the Splunk itself   ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

Hi @kjain041523 may i know if the issue is resolved or do you have further queries? if its resolved, could you pls accept it as solution, thanks      ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

Hi @anmolxmr  May i know which step or what error you got,.. more the details and more better the replies/answers will be, thanks.  ... View more

Hi @cipher  i am not much sure of this issue, but i thought to suggest you... for SplunkCloud, you could raise a Support ticket and you should receive good support from Splunk Support team. thanks.  ... View more