About gcusello

gcusello

Hi @cdCryptoMetrics , let me understand: you want to send Splunk Cloud data to a third party system, is it correct? at first I don't understand what you mean with "using SPL with Collect Command" because the collect command is used to store search data in an index and not to forward data. Anyway, if you want to send data arrived from on-premise systems to third party system, you could do this on the Heavy Forwarders that you should have as concentrator in your on-premise infrastructure. For my knowledge there isn't any other solution. Ciao. Giuseppe

gcusello

Hi @e_v_m , let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉

gcusello

Hi @e_v_m , I am agree with @VatsalJagani , at first I'd check if it's possible to upgrade the HF, mainly not because its old but because it's out of support so you cannot ask help to Splunk. If you need a temporary solution, you could use an intemediate HF with an higher versione of Splunk, but in this way you don't solve the main issue: you have a very old system in your architecture and data continue to pass through it. Ciao. Giuseppe

gcusello

Hi @0xAli , good for you, see next time! let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉

gcusello

Hi @0xAli , about the first assumption, it isn't correct: Schedule Mode (Continous or real-time) determine the type of the Scheduled Search(RTScheduled Search OR Historical Scheduled Search) historical scheduled Search can be operate at the Continuous mode ot the Real-time mode ? historical scheduled Search are in Continuous Mode, not in RT Mode, what's the sense of a RT historical search? A Real-time scheduled Search always uses Real-time scheduling by nature? yes Ciao. Giuseppe

gcusello

Hi @709_miner , ask the Forwarder License to the Splunk Cloud Support. Ciao. Giuseppe

gcusello

Hi @0xAli , is is clear for you or do you need other information? Ciao. Giuseppe

gcusello

Hi @0xAli , about first question: in Splunk a search takes a CPU (more if you have also subsearches in the main search) until it will finish, so a RT search takes one or more CPUs for always, it's better to schedule a search so it will release the CPUs when finised. About second question: No RT depends on how you configured your detections: scheduled or RT, as I said if you can avoid RT, otherwise give more resources (CPUs to your Indexers and Search Heads)! On Splunk Cloud RT searches are usually blocked for all not admin users! Ciao. Giuseppe

gcusello

Hi @jeremieQuiviger , why are you using another UF after the HF, you can use the HF for parsing and relay. Anyway, did you checked the throughtput through the UFs? by default they have 256 kb, instead HF is unlimited. The best solution is to replace the UF relay with an HF. Ciao. Giuseppe

gcusello

Hi @0xAli , your settings seem to be correct, the only way to proceed is to analyze the load on your SHs using the Monitoring Consle, in this way you can see the health status of your system and eventually put some tuning action, e.g.: check the scheduling of the scheduled searches, avoid to use real-time searches and transforms them in scheduled searches, optimize your custom searches, check the performances of the Data Models, etc... Ciao. Giuseppe

gcusello

Hi @JohnEGones , to properly configure the MC, you must connect it to the CM, in this way you have the CM and all the IDXs. Then you have to connect one by one all the SHs and (if present) the SHC-Deployer, at least the DS. Beware to a point of attention: it isn't a best practice to put the MC on the DS, particurarly if it has to manage more than 50 clients, it's better to put it on a dedicated server, or on the SHC-Deployer, or, if you have not very large data volumes on the CM: I usually put it on the SHC-Deployer. About Heavy Forwarders, they are usually not directly monitored by the MC: I usually create some custom dashboards to have all the information that I need and I'm not sure that connecting them to the MC you have the requested inormation. For more information to connect the MC to the other components see at https://help.splunk.com/en/splunk-enterprise/administer/monitor/9.2/configure-the-monitoring-console/configure-the-monitoring-console-in-distributed-mode Ciao. Giuseppe

gcusello

Hi @Dinkos , you are using the same time frame, but if you're using a relative timeframe, running the secondary search in a different moment, you are using two different time periods. I mean: did you tried to pass as tokens the earliest and latest values from your main search to the secondary search? e.g., if the time picker is called "Time", you should try to pass the tokens: earliest=$Time.earliest$&latest=$Time.latest$ Ciao. Giuseppe

gcusello

Hi @Dinkos , to the dropdown search, did you passed also the search or also the time borders? if you didn't passed the time borders, try to pass them. Ciao. Giuseppe

gcusello

Hi @kjain041523 , you must use as token the same field name of the Detection search, in yur case $host$ and not $Host$. Ciao. Giuseppe

gcusello

Hi @ekb , I suppose that you're speaking of a syslog input, is it correct? if not what kind of input are you using? If you are speaking of network or HEC inputs you must use a Load balancer in front of the two Heavy Forwarders, without it it's normal to have duplicated events using the same input on two machines. The best solution is to have a Load Balancer, otherwise, you should enable the input on only one machine. Ciao. Giuseppe

gcusello

Hi @0xAli , as also @PickleRick said: the best approach is to use a certified Architect from a trusted Splunk Partner. Ciao. Giuseppe

gcusello

Hi @Wohamed_wakkad , yes you can put in the same server LM and MC without any issue, remember to forward internal logs to Indexers. About the second question: for LM and MC I don't think that you can use the Forwarder License for the role of these servers, also beacuse you are speaking of the LM, by itself it hasn't license problems! Anywat, what is the problem? Ciao. Giuseppe

gcusello

Hi @0xAli , as @livehybrid said, the main difference is if you can use the same IP and hostname of the old machines. In this case, you could copy the $SPLUNK_HOME folder in the server and it will run. Only one attention point: remember to add the start at boot procedure. If instead you will have a different IP and hostname it's a longer process. I'm not an Hyper-V expert, but are you shure that you cannot import the VM in the new environment? Ciao. Giuseppe

gcusello

Hi at all, I agree with all the considerations from @0xAli, there's only one additional information: the sizing of using an indexer every 80-100 GB/day to index: this sizing arrives from the Enterprise Security Admin Course, but it isn't in any Splunk official documentation, infact working with the Splunk PS I received by them a different sizing: they hinted to use 150 GB/day per Indexer and, having very performant physical servers, also 200-250 GB/day per Indexer (this is the sizing from a Splunk architect of a project that I'm implementing ). What is the correct answer? I usually try to request a sizing to Splunk SE to be sure, if I must do the sizing by myself I use 150 GB/day per Indexer. Ciao. Giuseppe

gcusello

Hi @sirpatrick , At first: you are using a Universal or an Heavy Forwarder? Then, what kind of input are you using in this add-on? if API inputs, you should understand where the checkpoint is located (e.g. DB-Connect stores checkpoint in a KV-Store); if you are using only monitor, the checkpoint is in the _fishbucket folder, baut it shouldn't be relevant because in the new server you should have different files to read. Ciao. Giuseppe

gcusello · ‎06-05-2026

Hi @msrama5 , it isn't possible to export all the panels in CSV, but only one by one. Ans, as I said, if you have Post Process Search, you have to open each search in Search dashboard and then export in CSV. Ciao. Giuseppe

gcusello · ‎05-22-2026

Hi @SplunkWorthy , could you share a sample of your resulta ans logs? Ciao. Giuseppe

gcusello · ‎05-21-2026

Hi @spl_aficionado , what do you mean with active-active? you can configure only one DS for each client. You can also configure a Load Balancer with a VIP or a scaling DS. Ciao. Giuseppe

gcusello · ‎05-18-2026

Hi @himanshu2 , please don't call people in questions! Anyway, following the documentation, it's a known issue, you must follow the documentation during upgrade from 9.3.x to 9.4.x: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/administer-the-app-key-value-store/upgrade-the-kv-store-server-version Ciao. Giuseppe

gcusello · ‎05-18-2026

Hi @Wohamed_wakkad , as also @PickleRick said, following the Splunk best practices, you should use a dedicated machine to Deployment Server role if it has to manage more than 50 clients. Ciao. Giuseppe

Posts	15154
Solutions	2203
Karma Given	415
Karma Received	4517
Member Since	‎01-02-2019

Online Status	Online
Date Last Visited	yesterday

Data Model Accelerations are very slow

eval in stats with max

Treeview Viz

App menu bar

Sequence of activities at index time

tracking Splunk modifications

identify the sender of an HEC data flow

Create custom fields at indextime on Heavy Forward...

Quarantined heavy Forwarder

Issues in adding a lookup field in a Data Model

Re: Splunk Cloud ----> "Forwarding and receiving" ...

Re: HTTPOUT from an old Heavy Forwarder

Re: HTTPOUT from an old Heavy Forwarder

Re: SHC Concurrency Search control

Re: SHC Concurrency Search control

Re: Heavy Forwarder License

Re: SHC Concurrency Search control

Re: SHC Concurrency Search control

Re: Heavy Forwarder queue saturation for sending l...

Re: SHC Concurrency Search control

Re: Properly configuring the Monitoring Console

Re: DROPDOWN not showing all values

Re: DROPDOWN not showing all values

Re: Drill Down Search

Re: Two to three copies of every event after migra...

Re: Splunk Sizing: CPU and RAM

Re: LM and MC co-location , forward traffic to ind...

Re: Splunk Migration: From ESXI to Hyper-V

Re: Splunk Sizing: CPU and RAM

Re: Moving to new forwarder

Re: i am not seeing export classic dashboard to cs...

Re: Trasaction command displaying endswith field b...

Re: What is the recommended deployment architectur...

Re: Splunk Search Head Cluster Upgrade

Re: Co-locate the deployment server with other spl...

Join the Conversation