For anyone finding this, as this came up on Slack: [default] doesn't apply to modular inputs, most notably wineventlog. You'll need to add it to the top level stanza for that input type: [WinEventLog] _meta = hf_proxy::meta_test https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Specify_global_settings_for_Windows_Event_Log_inputs ... View more

The App for Infra team has been unable to reproduce this issue. Did the index name for the metrics change? ... View more

write_splunk is an extension to the write_http plugin. It does some metrics reformatting for common plugins like disk and cpu to set certain portions of the name such as volume or CPU as dimensions. It also pulls information about the host from the OS to add as dimensions as well. write_splunk is the recommended plugin to use for collectd as it allows for the addition of custom dimensions and in the most recent versions the ability to send to a UF before sending to splunk. It is also the plugin required to use data with SAI. ... View more

you can all try to uninstall completely and reinstall Splunk Universal Forwarder (using the powershell script on Add Data page) ... View more

The entity data is enriched with tags (tag=inventory tag=oshost). If you miss the tag=inventory, the oshost module link won't appear. ... View more

Is there a beta version of the app available or an ETA for the new version? I missed that it wasn't 6.5 compatible and upgraded. ... View more

Is there any way to change this? I don't really like that they are automatically weighted at 11 for the impacted service. Especially if it is a dependency that isn't as important as other ones. Also, if there are multiple things causing issues, I'd rather see a health score based on those multiple items, instead of whichever one is lower. This also makes the KPIs of Service A worth a lot less, or at least it seems that way. ... View more

Excellent question! Of course, I would be happy if they would simply indicate where in my clustered environment a particular app should be installed... on the cluster manager? Indexers? Search heads? Heavy forwarders? I know, it "depends on whether or not there's transforms, or, whatever..." You'd think that would be easy to indicate in on page-one of any docs where it goes... ... View more