Hi @jeremieQuiviger  UF relay layer is almost certainly the cause of your queue saturation, and the architecture itself is the root problem. Heavy Forwarder output capacity is substantial — it's a full Splunk instance with configurable output queues, TCP connection pooling, and parallel pipelines. but the UF's are designed to be sources not relays in your case HF pushes data at full speed, the UF relay can't keep up, and backpressure propagates back to fill the HF's output queue. as @PickleRick  said technically splunk allows HF->UF relay->Indexers but its not supported and recommended for Prodcution it should be like UF (collect) → HF (transform) → HF relay → Indexers ... View more

@yasir ,  can you try to remove the Stale lock pid files under the below directory $SPLUNK_HOME/var/lib/splunk/kvstore/mongo/ $SPLUNK_HOME/var/run/splunk/ after that restart the splunk services.   and cross check the ulimit values (its should meet Splunk minimum requirements) and THP status (its should be Never) in the server end. ... View more

@beataficek  refer the below Splunk official document to configure the webhook https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.4/configure-webhook-allow-list  ... View more

Splunk does not explicitly mention data source diversity as a primary factor for sizing indexers during the initial design phase. However, different data sources can generate heavier workloads depending on their format and processing requirements. In such cases, deploying Splunk Heavy Forwarder within the infrastructure can offload certain parsing and processing tasks from the indexers, which can help improve overall platform efficiency. ... View more

here is the Splunk official document for upgrading the SOAR https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/7.1.0/upgrade-splunk-soar-on-premises/upgrade-a-splunk-soar-on-premises-instance  ... View more

No, mixing both (FIPS and non FIPS) nodes in the same Splunk cluster is not supported. it is unsupported and will break SSL/TLS authentication. ... View more

@goelt2000 yes its supported, its clearly mentioned in the Splunk documents.     ... View more

Hi @Abirami_09 , you can select the version in the left side of the page. https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license  ... View more

Hi @Abirami_09 , Please find the inline comments License requirements: What type of license is needed for Splunk SOAR On-Prem in this setup? -- > Seat-based License Refer this https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license Process: How do we go about obtaining and applying the license for an HA deployment? --> there is no specific license for HA Best practices: Are there any specific considerations or documentation for licensing when configuring SOAR in HA mode? - refer the below document for further more details https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/7.0.0/build-a-splunk-soar-on-premises-cluster/about-splunk-soar-on-premises-clusters ... View more

@SN1 try the below log rotation script, modify the file log file name based on yours and setup the cron schedule based on your requirement. #!/bin/bash # Compress files >1 day old find "<path of log file location> -iname "firewall-*.log" -type f -mtime +1 -exec gzip {} \; # Delete .gz files >3 days old find <path of log file location> -name "firewall-*.log.gz" -type f -mtime +3 -exec rm {} \;   let me know if you are facing any issues. ... View more

@egko  remove the lock file and clean up the kvstore and do the restart   ... View more

@egko  Take the backup of KV store ref: https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.4/administer-the-app-key-value-store/back-up-and-restore-kv-store  and try to clean the kvstore and restart the splunk. check the status  splunk show kvstore-status --verbose splunk stop splunk clean kvstore --local splunk start please refer the below document as well for more details about kv store troubleshooting https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.0/welcome-to-splunk-enterprise-administration/administer-the-app-key-value-store/kv-store-troubleshooting-tools      ... View more

@DashZentin , it is clear that you are not using your new license, make use of your new license refer this page https://community.splunk.com/t5/Installation/Why-does-Splunk-enterprise-license-show-Status-FROM-THE-FUTURE/m-p/113186  ... View more

@DashZentin make sure you are using the right license, may be still its directed to the free license go to setting and license and check for the usage like below   its should be 932 MB/12,228 MB under the new license stack which you purchased. ... View more

@jarelloy As @PickleRick  said, in simple terms drop everything first and then pull back what you want exactly.   try the below    props.conf [source::/var/log/pods/hammy_*] TRANSFORMS-routing = set_null_for_hammy, whitelist_blausy transforms.conf [set_null_for_hammy] REGEX = . DEST_KEY = queue FORMAT = nullQueue [whitelist_blausy] SOURCE_KEY = MetaData:Source REGEX = /var/log/pods/hammy_blausy DEST_KEY = queue FORMAT = indexQueue       ... View more

@dm1  May be its because of authentication issue, log out from the splunk web and try to upload again. Make sure that the csv file format is not changed. for better clarification upload some other small csv file and check if you are facing the same issue by the way you can confirm there is no issue with csv file format. ... View more

@goelt2000 it will take sometime for the instances to be created. you should receive notification to the register mail address when it is ready. ... View more

@yassenfouadanis  It looks like this is a permissions issue. Because ECS Managed Instances don’t allow you to run commands directly on the host, you’ll need to fix it in the task definition instead. Please go to the ECS console, create a new revision of the task definition with your parameters, and add "user": "0" to the container definition (before the environment variables section). This will run the Splunk container as the root user so it can write to the EBS volume. Once everything is working, we can adjust the user configuration if needed. ... View more

@aneumeyer This add on directly pull the logs from the workday tenant and retrieving user activity through workday API's. This addon automatically parse the some of important logs streams and its readily available while searching the workday data in the Splunk.   ... View more

@yassenfouadanis  from the logs i can see the issue is because of permission when mounting EBS volume to the container, you should set the owner as splunk before launching splunk use the below command to change the permission to splunk as a owner chown -R splunk:splunk /opt/splunk ... View more

@SOAR_098  The error which you encountered is because of ssl cert , the ssl cert is not trusted by the server. Import the necessary cert to the host, you can refer the below url for more reference. https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-splunk-soar-on-premises-certificate-store/add-remove-or-replace-certificates-from-the-splunk-soar-on-premises-certificate-store  ... View more

@UncleHugo  Enable the Deployment server on the server on your splunk home bath under bin dir splunk enable deploy-server Splukn restart This is the switch that makes Forwarder Management(Agent management) show up in the UI. On each client execute the below command set deploy-poll <YourDeploymentServerFQDN>:8089 -auth admin:<password> then restart the service, basically it will create the deploymentclient.conf on the client machine and it will include the below details [deployment-client] [target-broker:deploymentServer] targetUri = <YourDeploymentServerFQDN>:8089   you can refer the below URL for more details,   https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/9.0/configure-the-dep... ... View more

@maheshnc , Backup the entire $SPLUNK_HOME/etc/ directory. basically it will cover all of your config related files. ... View more