What would be a “safe” value for the TRUNCATE option in props.conf? I have some pretty big json events coming via HEC hitting the _json sourcetype (INDEXED_EXTRACTIONS=json). ... View more

Is there a way to tell the app that I've built for Splunk Cloud to get installed only on the search head? We want to limit the restart of indexers on Splunk Cloud. We use the "App Management" for vetting and then install it. ... View more

We have two search heads: - First is used with Enterprise Security with CIM installed and acceleration enabled on some datamodels - On the second one(no enterprise security) we also have installed CIM, but manually, and haven't enabled acceleration on any datamodel What would be the impact of having different acceleration settings enabled for each search head? ... View more

We need to determine if an app suffered local changes. Is there a way to leverage the | rest command to do it since we have Splunk Cloud and we can't actually look into the etc/apps directory? Consider this scenario: 1. We have app version 1.0.0 installed on the splunk cloud search head 2. We discover a bug and we fix it on our own by editing the dashboard, fieldextractions, etc 3. Developer releases 1.0.1 and also fixes the issue but offers more features 4. When we update the app the local directory will persist and thus we won't have the fixes from the developer since local has precedence over the default directory ... View more

The host input dropdown in the Netskope App shows an error that it "Cound not create search.". By looking at the dashboard xml source we observe: <label>Host Input</label> <default>*</default> <choice value="*">All</choice> <search> <query>| `netskope_configured_inputs`</query> <earliest>$time_range.earliest$</earliest> <latest>$time_range.latest$</latest> </search> If we remove the leading pipe (|) from the query the error is gone. The dropdown will now show the FQDN of the Netskope server which feeds the events. I'm wondering if this is the expected behavior. I would have expected to see the computer names under this dropdown. ... View more