I have reviewed similar questions but haven't found a fix to this. My windows UF is utilizing high memory and processes, causing the servers to become inaccessible. I'm having too many powershell scripts launched, although I have disabled all the PS scripts in the deployed TA_windows . Is there anywhere else in Splunk I need to look for PS Scripts that may be causing this problem? ... View more

Anyone knows if Splunk for Cisco Identity Services is compatible with Splunk Enterprise Version: 8.0.1 or is there another app I could use for the same purpose? Thanks. ... View more

My Cisco Indexer just stopped indexing new data. Splunk is receiving data from the Syslog server but just not getting index and so nothing is showing in the Cisco Networks apps/addon. I do have an input/output file on my syslog servers through UF that is monitoring the folder with the logs, which is not the problem since i can see current&old logs in the SH. The output is pointing to my HF which forwards the data to the Idexer. I'm running 8.0.1 with 1 server each SH, IDX, DP, HF. I know it's not indexing cuz my indexer haven't received data for at least a day and there are no errors in the the logs. ... View more

I'm doing a new install with 8.0.1 and want to install the Splunk App for Unix and Linux that is compatible with ver. 8.0.1. to collect data. I have a HF, SH Idx and Deployment servers. The document doesn't mentioned 8.0 anyone knows if it will work? ... View more

I've my cisco devices sending the logs to kiwi syslog server and writing them to several files, (ise,switches,asa...). I need to monitor and ingest the data. Which servers do I setup the monitoring on? I've 1 search,deployment,indexer,HF each. ... View more

I created a indexes.conf file and placed it in myallindexes to keep them in one central location for easy management, which is in the apps folder on the indexer, forwarder, and deployment apps. Now all of my indexes are pointing to the same app. Is that normal, if not how do i change it back.? If i just delete it from these locations all the other apps goes away except the systems ones. How/where do I change them back. My environment 1 search head, 1 deployment server, 1 indexer, 1 Heavy forwarder, etc Name Actions Type App Current Size Max Size ? Event Count Status audit Edit Delete Disable Events myallindexes 16 MB 488.28 GB 123K 11 days _internal Edit Delete Disable Events myallindexes 1.43 GB 488.28 GB 13.5M 2 months _introspection Edit Delete Disable Events mysallindexes 1.38 GB 488.28 GB 1.46M 2 months _metrics Edit Delete Disable Metrics myallindexes 571 MB 488.28 GB 6.05M 2 months _telemetry Edit Delete Disable Events myallindexes 1 MB 488.28 GB msad Edit Delete Disable Events myallindexes 1 MB 488.28 GB 0 asa Edit Delete Disable Events myallindexes 1 MB 488.28 GB 0 ios Edit Delete Disable Events myallindexes 1 MB 488.28 GB 0 ise Edit Delete Disable Events myall_indexes 1 MB 488.28 GB 0 linux Edit Delete Disable Events myallindexes 1 MB 488.28 GB 0 windows Edit Delete Disable Events myallindexes 1 MB 488.28 GB 0 main Edit Delete Disable Events my_allindexes 1 MB 488.28 GB 0 ... View more

Do I need to specify or create each index folder/bucket when doing coldToFrozen at the new location or is it automatically created? ... View more

I'm trying to configure SAML in my Windows Enterprise Environment and keep getting this error: SAML has already been configured, Cannot add a new SAML configuration.saml I can't make any change at all. When I cancelled and come back in, it's says "SAML is not configured" but when I tried configuring SAML I get the error "SAML has already been configured". ... View more

How can I find out what changed in my Splunk Windows environment or how can I compare daily ingested data between days. Up to 4 days ago, my Splunk daily license used was about 50%, now it's down to about 25% almost half of what it has been. My domain environment is still the same, with the the exception of Kiwi Syslog upgrade with the same rules and configurations and logs are been generated and ingested, so unless ... View more

ServerSideInclude Module Error! Invalid template path. C:\APP\splunkappfor_nix\appserver\static\settings.html but my application is on a different drive and can't get into settings to change it? ... View more