×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
nelis249
Explorer
Member since: ‎11-20-2015
‎01-19-2026
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 1
Member Since ‎11-20-2015
View All

Re: MC Historic License Usage Broken

by in Monitoring Splunk
‎01-19-2026 11:47 AM
1 Karma
‎01-19-2026 11:47 AM
1 Karma
In case anyone ends up on this article.  Previous version: 9.3 Upgraded to: 10.0 I had this exact same behavior. The above fix did not work for me either. No special server, just a single indexer. I had to modify 3 different macros. dmc_licensing_summery_no_split dmc_licensing_summery_pct_no_split dmc_licensing_summary_maxavg_no_split On each of these, the queries have: | stats latest(b) AS b by slave, pool, _time | I had to remove the 'slave' from each of them for it to return properly.     ... View more

Re: Fortinet FortiGate App for Splunk not showing ...

by in All Apps and Add-ons
‎09-27-2022 08:54 AM
‎09-27-2022 08:54 AM
I too am having the same problem. The fortigate apps are installed and are ingesting if I search with index="*" sourcetype=fgt_logs but none of the dashboards provided by the app show anything. There has to be some type of transform or data source not configured right. ... View more

Re: How to disable the modal pop-up "Help us to im...

by in Security
‎07-22-2019 10:17 AM
‎07-22-2019 10:17 AM
I know this is an old thread but I've been trying to figure this out as well on Splunk Enterprise 7. These settings do not seem to work. I even tried the custom folder MY_user_settings. The btool output shows the settings are configured. Seems like Splunk would have a simple setting like the 'userTour' option to not show the help improve modal. ... View more

How do you change the index to something else than...

by in Splunk Dev
‎08-18-2017 03:32 PM
‎08-18-2017 03:32 PM
Using Splunk 6.5. Right when you login, you land on the 'Search app'. On this screen there's a section called 'What to Search' and lists some info such as hosts, sources, and sourcetypes. This information is all being pulled from the index=main. I've looked around and I'm not seeing any information on how to actually change it from that index to something like index=mycustomindex. That way when I login I would be presented with data and counts from my custom index versus the 'main' index which I'm not really using. I've found articles on changing the default index with defaultDatabase = but that doesn't seem to work. Maybe I'm updating the wrong .conf file. I've even search the xml files replacing 'main' with 'mycustomindex' and it still doesn't change the pages behavior. Has anyone else figured this out? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎01-19-2026 11:42 AM
Karma from
View All