As stated by others the docker images available from splunk currently do not target the ARM architecture. There is the rosetta2 option but I've just read about it and not tested it myself. But having Splunk built images would be a better solution. I use splunk docker containers a lot during development of my TAs and Apps, although I'm still using a intel based Mac, I'm about to change that soon. So here is and idea I submitted earlier that you can upvote: https://ideas.splunk.com/ideas/EID-I-1054 Alternatively, you could build your own docker images. I do not own a M1 Mac yet but this is something I would consider if this was a pressing issue. ... View more

I got the same problem too, did anyone get a solution to this? ... View more

I thought that would be it. Just to confirm, we set KV_MODE = none on search head, under the same sourcetype stanza. Changing the configuration files from the file system would require a restart. ... View more

You can still use CIDR, it is just not an explicit type. You should be able to just mark CIDR on the lookup, and use string as the type for the collection instead of CIDR. I've updated the docs that you linked in your post. I hope this resolves your issue! ... View more