Be careful with the command because if you have an archived folder of '/opt/splunk/etc/' in $HOSTNAME.tgz, you are telling your instance to place this directory in /opt/splunk/etc/. What this could do is place your 'etc' folder in the last directory you specify after -C, so the backup's 'etc/' folder would be placed in /opt/splunk/etc/etc <- here. the following command should suffice: tar -xzvf /opt/HOSTNAME.tgz -C /opt/splunk/ It is my recommendation to always run scenarios like this in your own test environment before trying to perform backup and and restores of production tools. ... View more

This is previously answered here: https://community.splunk.com/t5/Splunk-Enterprise/Configuration-Backup/m-p/577865 All of the ESSENTIAL configurations are found in $SPLUNK_HOME/etc/. In this hypothetical scenario, you would want to ensure this folder is captured. It includes the following: - Splunk Enteprise License $SPLUNK_HOME/etc/licenses - Splunk user knowledge objects $SPLUNK_HOME/etc/apps/<app_name>/local/* What is NOT included in this backup and restore of $SPLUNK_HOME/etc/ is the indexed data as that is stored in $SPLUNK_HOME/var/lib/splunk/* (may be $SPLUNK_DB/) So if you are asking to backup and restore a single instance of Splunk? You would want to ensure you include $SPLUNK_DB ($SPLUNK_HOME/var/lib/splunk/* ... View more

Is it just splunkweb that will not start or both splunkweb and splunkd? ... View more

Seeing two different _time formats here. I see 2020-03-09T 14:30:39+00:00 and then I am also seeing epoch times in "firstSeen"1538579956000, "lastSeen"1583764287000 and "time". Is this a partial log file? Are you only trying to load this snippet of a log in to splunk or the entire log file? ... View more

Side note, you would not need the | fields process_cpu_used_percent host line. The timechart would give you the exact output you want. ... View more

Give this a try: `CPU` earliest=-17h latest=-8h | fields process_cpu_used_percent host | eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20", process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40", process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60") | timechart span=1h avg(process_cpu_used_percent) as cpu_average by host Hope this helps! ... View more

Check out this app Splunk Add-on for Microsoft Cloud Services If you think this would be a solution here is instructions to Install the Splunk Add-on for Microsoft Cloud Services ... View more

Now that we know that your search head is clustered, you need to install the app from the deployer as @nickhillscpl said. ... View more

Were there any other logs for upgrade_readiness_app or was this the only one? /storage/collecitons/config is a API call for KV store endpoints to access and create collections. So its very interesting that this is error message for an attempted installation. ... View more

Have you checked to see if there was an error during the install? Have you checked your splunkd.log? ... View more

The upgrade from 7.0x to 8.x was on the indexers, and the rest of your environment was upgraded as well? ... View more

Lets try and figure out if it is a search issue or a lookup file issue. Can you return the lookup file by using inputlookup ? | inputlookup networklist_allocs_all This will return the full lookup file in the format you showed. network,descr 192.168.0.0/24,network_name If you get results, then your lookup file is fine. If you do not, then there is something wrong with this lookup file and needs further investigation. ... View more

I am not 100% sure if indexers can forward data the way you are requesting. This would mean that before indexers can parse and begin indexing the data, you want them to first send the uncooked data to other systems. ... View more

If the table you are wanting to present at the end does not have all the fields then you do not need to add the eval IDs , makemv IDs or dedup ID because that is just extra work for your search. The question to ask is what exactly you want as your result, then tailor your search to fit your results. ... View more

I never had stats in my search, so I am not sure how you are getting the same table. What you are looking for then is index=ibldc-db sourcetype="flit_info" OR sourcetype="flit_comp" | dedup ID | rename FLIT_INSTRUCTION_ID as IDc, DU as DISPATCH_UNIT, BUNDLE_COMPONENT as FLIT_COMPONENTS, RULE_ID as FLIT_RULE_ID | eval IDs=coalesce(IDc, ID) | makemv IDs | table PART_NUMBER, FLIT_COMPONENTS, AMOUNT Feel free to add whatever fields after table as you would like. Especially if you want the IDs field in the table or not. ... View more

So this error is appearing when you attempt to add the UDP port 8125 monitor input. I am assuming that UDP port is being used by statsd as you had stated. From the error, it sounds like splunk is trying to use udp port 8125 instead of monitor. Have you tried adding a udp stanza to an inputs.conf file directly? Give this a try. See Configure a UDP input in Get data from TCP and UDP ports. It is best practice to create a new app in /etc/apps for this new data source, but just try adding that [udp://..] stanza to $SPLUNK_HOME/etc/system/local/inputs.conf. After you add the stanza make sure to restart splunk, and check if that works. ... View more

What steps are you doing to configure your statsd daemon input? Have you got splunk installed and running before setting up your input? ... View more

Give this a try: | where user!="" AND usr_mod=="" | stats list ... View more

You do not want to chart individual users correct? Because that could be a MASSIVELY long chart if you have hundreds of users. You just want a TOTAL COUNT of users found and not found? ... View more

Do you have the privileges to copy your image file to $SPLUNK_HOME/etc/apps/your_app/static to your cloud instance? I am not familiar with Splunk Cloud, but I just signed up for the trial to try and figure this out. ... View more

I think the join is working as intended. Because the same event that lives in your 25_million_Linie_Rule.csv also would be found in your real-time main search. Doing the join should not remove events found in your main search that match those events in your 25_million_Linie_Rule.csv as I think you want. ... View more

According to Splunk Docs Deploy and Use the Splunk Add-on for Windows, yes you will need to upgrade in this order: Upgrade from 4.8.1 to 5.0.1. See Splunk Docs Upgrade from version 4.8.4 to version 5.0.1 Upgrade from 5.0.1 to 6.0.0. See Splunk Docs Upgrade from version 5.0.1 to 6.0.0 section in Upgrade the Splunk Add-on for Windows Upgrade 6.0.0 to 7.0.0. See splunk Docs Upgrade from version 6.0.0 to 7.0.0 section in Upgrade the Splunk Add-on for Windows Each page lists specific conf file changes that will need to be made and other application changes needed before updating. ... View more

Splunk Docs has good documentation explaining how to whitelist and blacklist file paths. The blacklist and whitelist sections requires custom regex expressions. So yes, there are ways to blacklist all files of a specific file type .bz2 in your case. See the Blacklist (ignore) files in Whitelist or blacklist specific incoming data ... View more

Are you sending these as [syslog] to the 2 F5 VIPs because that is the only port open on those hosts? Is the indexer cluster stanza using [syslog] and has to send via port 514(UDP) too? ... View more

I have a lot of questions.. can you clarify: What are your incoming Windows Logs so we can understand if these are generic OTS Windows logs or if they are syslog in nature? How these incoming Windows Logs sitting on the HF you mentioned in your title or from other UFs maybe? Are these 2 F5 VIPs doubling as indexers for your Splunk architecture or do these incoming logs get to indexers at some point? ... View more