As an update to this (since I've recently had to look into this) - for our Splunk Cloud customers, you can use the following search:   index=_internal source=*splunkd.log host=c0m1* component=CMMasterRemoteStorageThread freezing reason=* | convert ctime(bucket_earliest) AS Earliest_Event | convert ctime(bucket_latest) AS Latest_Event | convert ctime(_time) AS Event_Time | table Event_Time,idx,Earliest_Event,Latest_Event,reason Hope this helps!  ... View more

Are you a Splunk Cloud Customer or just running it in AWS? Are these scheduled searches or just normal adhoc searches? This will get you general information (set the visualization options to "Multi Series Mode" - Yes and and Y Axis - "Axis Range" to Independent. Change host= to your appropriate search head.. index=_audit action=search host=<hostname> NOT search_id="rsa_scheduler*" NOT *ACCELERATE_DM* (info="completed" OR status=success) | timechart span=5m count as NumSearches p90(total_run_time) AS p90TimeInSeconds avg(total_run_time) AS AvgRunTimeInSeconds median(total_run_time) AS MedianRunTimeInSeconds | eval MedianRunTimeInSeconds=round(MedianRunTimeInSeconds,1) | eval p90TimeInSeconds=round(p90TimeInSeconds,1) | rename savedsearch_name as title ... View more

Let's start simple: Do you have the index set up on the indexer? Do you see any alerts regarding getting data for a non-configured index? If you run a real time all time search for index=squid, do you see events coming in with the correct timestamps being extracted? ... View more

For Reference: https://www.splunk.com/en_us/legal/splunk-cloud-service-maintenance-policy.html We try to work with individual customers based on the work requested to find a good window to do the work requested. If you desire to have a scheduled maintenance, please feel free to open up a support case (or work through your sales rep) to get one set up. Brian ... View more

Unfortunately scripted authentication is not supported in Splunk Cloud. ... View more

Please see the documentation here: https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/User/HowSAMLSSOworks Brian ... View more

Can you provide information around what version you are using? Where did you see the errors? Can you run the following command and provide the entire version string like so? /opt/splunk/bin/splunk version Splunk 7.0.1 (build 2b5b15c4ee89) ... View more

What was the case number on this so I can follow up please. ... View more

Muebel - can you check the pass4SymmKey in the forwarders outputs.conf and the pass4SymmKey in the [indexer_discovery] stanza in the server.conf of the cluster master? ... View more

This was an issue over a year ago - are you still having issues? ... View more

This is known, and not something that will be fixed. Brian ... View more

Brent, As a Splunk support engineer, I would highly discourage you from messing with the scripts like that. If your boxes are under spec'd, and you have an issue, the first thing we will do is tell you to get the boxes up to the minimum specs. Especially if you're running an application that is heavily dependent on box specifications such as Enterprise Security. Brian ... View more

Unfortunately at this time there's no plans in have Splunk running on Linux ZFS. As Nnmiller mentioned, you may want to file an enhancement request. In addition, your attempts at working around the testing will still cause issues if you have to open a case with Support - please use a supported file system.. Brian ... View more

Couple of questions: Are you running any applications in the cloud? Do you have any field extractions that may be overwriting the hostname? While you are setting the hostname at input time, you can overwrite it when it gets to the indexer.. ... View more

At this time, there are no plans to support FreeBSD in the next major release of Splunk except as an Universal Forwarder. It hasn't been determined at this time support plans for FreeBSD past that release. Brian ... View more

Splunk should automatically pick up the date. If you need to configure date recognition, you will need to use props.conf. ... View more

This is due to a difference of the default CHARSET setting in the props.conf in Windows vs. Linux. By default, the CHARSET in Windows is set to AUTO, and will determine which CHARSET to use. In Linux, it defaults to UTF-8. The fix is to add the following to the props.conf: [mysourcetype] CHARSET=UTF16-LE ... View more

That fix was for a different error: "A threat intelligence download has failed" stanza=“stanza_name" status="threat list download failed after multiple retries" This one sounds like a permissions issue. Are you running Windows? Have you checked the permissions on the destination file that it's trying to overwrite? ... View more