Hi All, my customers security engineer has left the organization and we're curious how we can migrate the dashboards he was using over to other user profiles in Splunk Cloud.  Thank you! ... View more

how can we get Splunk license % usage data over long period of time? The following query only gives us last 2 months of data: index=_internal source="license_usage.log" type=usage idx="" | eval MB = round(b/1024/1024,2) | timechart span=1d sum(MB) by idx | addtotals ... View more

One of the main questions we have right now is - where are the Universal Forwarders installed? We had talked about having them on each client and having a deployment server to control pushing configs out to those clients. Correct? We were discussing this and wondering: • How does the traffic going out to the Splunk Cloud, get throttled? • How does the Deployment Server interact with each client? • Is there an agent? The second thing is DBConnect. In our “Manage apps”, I see a message saying we need to request this app be installed. How does the DB connect app on Splunk Cloud, talk to our SQL servers? Will it do this through the deployment server? In one way we were wondering if it might be easier to have everything route though the heavy forwarder than to try and get the ports open on every server. Also, do we need to purchase licenses to install Splunk Enterprise on the Heavy Forwarder and Deployment Server if we go that way? Thanks!! ... View more