I recently tested an upgrade from Splunk Enterprise 9.2.4 to 10.2.1 and encountered a few hurdles that led to a specific UI issue. I'm looking for the best practice to resolve this or if there's a known fix for the following scenario: The Upgrade Process: Upgraded from 9.2.4 to 10.2.1. Encountered the new restriction where Splunk won't start as root when using privileged ports (I was previously using web-port 443). Migrated the service to run as the 'splunk' user. Changed ownership of the entire $SPLUNK_HOME to the 'splunk' user ( chown -R splunk:splunk ). Updated web.conf to use port 8443 instead of 443. The Issue: Splunk starts successfully, but now all Saved Searches and Alerts are "grayed out" in the Web UI. I can see the search strings, but I cannot modify the query or any alert actions via the Edit button. Questions: Did the migration from root to the 'splunk' user miss a specific metadata flag that causes the UI to lock these objects? What is the recommended way to "un-gray" these searches without manually recreating them? Any insights or best practices for this 9.x to 10.x migration path would be greatly appreciated! Thank you.   ... View more

Hello,   I created a dashboard with a table and multiple charts. After the table query is finished, I create a token ($job.sid$). Then, I use this token for the other charts (loadjob command). I noticed that after the table loads completely, the charts begin loading data. Sometimes the charts load quickly, and sometimes they load very slowly. After changing the charts to use the full query instead, they always load quickly. Why is that? I thought that loading data from the table and using it in the charts would be better. ... View more

Hi, I am test using Edge Processor (Data Management). I have just enable Edge Processors from Data Management App on Splunk 10.0.2 I have an error while Add an Edge Processor "There was a problem creating your new Edge Processor.Missing valid auth token"  after click Save button My user have 4 roles (admin, data_management_admin, data_management_agent, data_management_agent_spl2) . What should I do? Data Management  ... View more

I have a question about modify kvstore configuration in search head cluster environment.   I have created kvstore with lookup editor app from a search head instance. Now, I would like to add a new column. So, I have to modify from collections.conf right?. However, the configuration is not on SHC but search head instances. What is the best way to add a new column of kvstore?   Thank you ... View more

I have a search with generate dynamic the column name with pattern "Month - Year" eg. "October - 2018" "November - 2018" "December - 2018". However, splunk orders the column by alphabet. So, I have an idea to convert them to unix time and then convert the column name back with javascript. How do I rename column name with javascript? ... View more

I could retrieve VNX Block Data except VNX File Data. I found error in ta_vnx.log. How do I fix this issue. 2018-08-28 11:18:35,830 INFO 140323441321728 - Start vnx_data_loader://sf_vnx_file. Metric=vnx_file_sys_performance 2018-08-28 11:18:35,831 INFO 140323451811584 - Start vnx_data_loader://sf_vnx_file. Metric=vnx_file_nfs_performance 2018-08-28 11:18:35,844 ERROR 140323441321728 - platform=Vnx File,ip=172.30.114.102,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer 2018-08-28 11:18:35,844 ERROR 140323451811584 - platform=Vnx File,ip=172.30.114.102,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer 2018-08-28 11:18:35,855 ERROR 140323441321728 - platform=Vnx File,ip=172.30.114.103,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer 2018-08-28 11:18:35,855 INFO 140323441321728 - End vnx_data_loader://sf_vnx_file. Metric=vnx_file_sys_performance 2018-08-28 11:18:35,856 ERROR 140323451811584 - platform=Vnx File,ip=172.30.114.103,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer 2018-08-28 11:18:35,856 INFO 140323451811584 - End vnx_data_loader://sf_vnx_file. Metric=vnx_file_nfs_performance ... View more

I setup splunk insights for infrastructure more than 2 months. I notice that I cannot change time older than 30 days. I need to search the metric and logs older than 30 days. What should I do? ... View more