@SN1 try the below log rotation script, modify the file log file name based on yours and setup the cron schedule based on your requirement. #!/bin/bash # Compress files >1 day old find "<path of log file location> -iname "firewall-*.log" -type f -mtime +1 -exec gzip {} \; # Delete .gz files >3 days old find <path of log file location> -name "firewall-*.log.gz" -type f -mtime +3 -exec rm {} \;   let me know if you are facing any issues. ... View more

@egko  remove the lock file and clean up the kvstore and do the restart   ... View more

@egko  Take the backup of KV store ref: https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.4/administer-the-app-key-value-store/back-up-and-restore-kv-store  and try to clean the kvstore and restart the splunk. check the status  splunk show kvstore-status --verbose splunk stop splunk clean kvstore --local splunk start please refer the below document as well for more details about kv store troubleshooting https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.0/welcome-to-splunk-enterprise-administration/administer-the-app-key-value-store/kv-store-troubleshooting-tools      ... View more

@DashZentin , it is clear that you are not using your new license, make use of your new license refer this page https://community.splunk.com/t5/Installation/Why-does-Splunk-enterprise-license-show-Status-FROM-THE-FUTURE/m-p/113186  ... View more

@DashZentin make sure you are using the right license, may be still its directed to the free license go to setting and license and check for the usage like below   its should be 932 MB/12,228 MB under the new license stack which you purchased. ... View more

@jarelloy As @PickleRick  said, in simple terms drop everything first and then pull back what you want exactly.   try the below    props.conf [source::/var/log/pods/hammy_*] TRANSFORMS-routing = set_null_for_hammy, whitelist_blausy transforms.conf [set_null_for_hammy] REGEX = . DEST_KEY = queue FORMAT = nullQueue [whitelist_blausy] SOURCE_KEY = MetaData:Source REGEX = /var/log/pods/hammy_blausy DEST_KEY = queue FORMAT = indexQueue       ... View more

@dm1  May be its because of authentication issue, log out from the splunk web and try to upload again. Make sure that the csv file format is not changed. for better clarification upload some other small csv file and check if you are facing the same issue by the way you can confirm there is no issue with csv file format. ... View more

@goelt2000 it will take sometime for the instances to be created. you should receive notification to the register mail address when it is ready. ... View more

@yassenfouadanis  It looks like this is a permissions issue. Because ECS Managed Instances don’t allow you to run commands directly on the host, you’ll need to fix it in the task definition instead. Please go to the ECS console, create a new revision of the task definition with your parameters, and add "user": "0" to the container definition (before the environment variables section). This will run the Splunk container as the root user so it can write to the EBS volume. Once everything is working, we can adjust the user configuration if needed. ... View more

@aneumeyer This add on directly pull the logs from the workday tenant and retrieving user activity through workday API's. This addon automatically parse the some of important logs streams and its readily available while searching the workday data in the Splunk.   ... View more

@yassenfouadanis  from the logs i can see the issue is because of permission when mounting EBS volume to the container, you should set the owner as splunk before launching splunk use the below command to change the permission to splunk as a owner chown -R splunk:splunk /opt/splunk ... View more

@SOAR_098  The error which you encountered is because of ssl cert , the ssl cert is not trusted by the server. Import the necessary cert to the host, you can refer the below url for more reference. https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-splunk-soar-on-premises-certificate-store/add-remove-or-replace-certificates-from-the-splunk-soar-on-premises-certificate-store  ... View more

@UncleHugo  Enable the Deployment server on the server on your splunk home bath under bin dir splunk enable deploy-server Splukn restart This is the switch that makes Forwarder Management(Agent management) show up in the UI. On each client execute the below command set deploy-poll <YourDeploymentServerFQDN>:8089 -auth admin:<password> then restart the service, basically it will create the deploymentclient.conf on the client machine and it will include the below details [deployment-client] [target-broker:deploymentServer] targetUri = <YourDeploymentServerFQDN>:8089   you can refer the below URL for more details,   https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.0/configure-the-dep... ... View more

@maheshnc , Backup the entire $SPLUNK_HOME/etc/ directory. basically it will cover all of your config related files. ... View more

@Sam_Kurdy  Can you click on Agent management from 10.0 version onwards Forwarder Management renamed as Agent management  ref: https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/10.0/agent-management/about-agent-management    ... View more

@Sam_Kurdy  yes its possible through the Splunk Deployment Server, Enable the Deployment server on the server on your splunk home bath under bin dir splunk enable deploy-server Splukn restart This is the switch that makes Forwarder Management show up in the UI. On each client execute the below command set deploy-poll <YourDeploymentServerFQDN>:8089 -auth admin:<password> then restart the service, basically it will create the deploymentclient.conf on the client machine and it will include the below details [deployment-client] [target-broker:deploymentServer] targetUri = <YourDeploymentServerFQDN>:8089   you can refer the below URL for more details,   https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.0/configure-the-deployment-system/configure-deployment-clients   Let me know if you need any additional help on this.     ... View more

@maheshnc Yes, ideally all your Splunk components—indexers, search heads, deployers, cluster managers, and heavy forwarders—should run the same version and its recommended from Splunk.   Refer the below URL for Compatibility matrix: https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-products-version-compatibility/splunk-products-version-compatibility-matrix    For forwarders (both Universal and Heavy), Splunk officially supports a compatibility window where forwarders can be up to two major versions older than your indexers. You can find Splunk’s detailed compatibility guidelines at the official documentation link you referenced, which covers all combinations and exceptional scenarios.   refer the below url: https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-products-version-compatibility/compatibility-between-forwarders-and-splunk-enterprise-indexers      High Level upgrade plan   -> Pre check   Apps/TA compatibility with the new version which you going to upgrade Backup the Splunk etc folder, certs and KV store -> follow the upgrade sequence order -> Post upgrade: verify the cluster health and review the splunkd logs, if you have DMC in your infra go through the          console and do the health check ... View more

@maheshnc  Please refer this url https://community.splunk.com/t5/Installation/What-s-the-order-of-operations-for-upgrading-Splunk-Enterprise/m-p/408003  ... View more

@fzel , please refer this doc https://help.splunk.com/en/splunk-cloud-platform/get-started/splunk-validated-architectures/applied-svas/splunk-operator-for-kubernetes  ... View more

Hi @_Raj , you can refer the below steps to enable the clustering part Pre-requisites -> Ensure all Splunk instances have compatible versions. -> Network connectivity and required firewall ports between all instances must be open. -> Have a look on the License part as well Configure Cluster Manager (Master Node) 1. On the instance to be Cluster Master, run these commands under $SPLUNKHOME path usually /opt/splunk/bin splunk edit cluster-config -mode master -replication_factor <number> -search_factor <number> -secret <your_security_key> -cluster_label <your_cluster_name> 2. Restart the Splunk Configure Indexer Cluster Members (3 Indexers) 1.Enable indexer clustering and set the master URI and secret: splunk edit cluster-config -mode peer -master_uri <uri_of_cluster_master>:<management_port> -replication_port <replication_port> -secret <security_key> 2. Then Splunk restart and validate the Splunkd logs ref: https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/9.4/configure-the-peers/configure-peer-nodes-with-the-cli#id_0df861c8_c6f3_4a89_850e_1a2d82f7bac8__Configure_peer_nodes_with_the_CLI   Configure Search Head Cluster (3 Search Heads) -> On one Search Head, enable search head clustering and bootstrap the cluster, execute the below command on the Splunk bin path splunk init shcluster-config -auth <username>:<password> -mgmt_uri <URI>:<management_port> -replication_port <replication_port> -replication_factor <n> -conf_deploy_fetch_url <URL>:<management_port> -secret <security_key> -shcluster_label <label> repeat for the other two nodes splunk restart Run the splunk bootstrap shcluster-captain command on the selected instance: splunk bootstrap shcluster-captain -servers_list "<URI>:<management_port>,<URI>:<management_port>,..." -auth <username>:<password> Ref: https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/deploy-search-head-clustering/deploy-a-search-head-cluster#id_1d3fdf18_058b_4743_9eba_b33686542953__Deploy_a_search_head_cluster  ... View more

Hi @HasterHerman  My suggestion is try to use the Generic S3 input in the Splunk Add-on for AWS, you can ingest logs collected from multiple AWS accounts sent to a central S3 bucket. The S3 bucket typically contains logs from different accounts and different CloudWatch log groups, organized via the S3 key/prefix convention (such as AWSLogs/<AccountID>/<log-group-name>/...). This allows you to pull and distinguish logs from various groups and accounts.   ... View more

@bt2025  Please follow the below steps to reset the Splunk login 1. Navigate to the Splunk configuration directory <Splunk installation directory>/splunk/etc/ 2. Back up the existing password file mv passwd passwd.backup 3. Go to the local system configuration folder <Splunk installation directory>/splunk/etc/system/local/ 4. Create a new file named user-seed.conf Add the following contents inside the file (replace <newpassword> with your desired password): [user_info] USERNAME = admin PASSWORD = <newpassword> 5. Restart Splunk from the command line <Splunk installation directory>/splunk/bin/splunk restart ... View more

@lwray21 You cannot currently enforce TLS 1.3 for Splunk HEC traffic; Splunk only supports up to TLS 1.2 for inbound HEC connections, so an ALB with TLS 1.3-only policy will not work. ... View more