Hi @poojas89  Did you follow the installation instructions on the Splunkbase app page at https://splunkbase.splunk.com/app/8308#Installation:~:text=Details-,Installation,-Troubleshooting ? If you are still struggling you could reach out to the developer using their Support email: [email protected] or raise an issue on the app GitHub repo at https://github.com/rootiq-ai/splunk_genai_observability   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Na_Kang_Lim  Data Manager is not available on Splunk Cloud Platform trial instances. For a trial environment, use the Splunk Add-on for Amazon Web Services app instead as @gcusello mentions   To set this up: Create an IAM User with programmatic access keys, and configure the user in the add-on under Configuration > Account. Set up an IAM Role containing the required CloudWatch read permissions, configured with a trust policy that allows the IAM User to assume it. If security is a concern regarding IAM users/keys, add an IP restriction condition (aws:SourceIp) to the IAM policy to restrict calls strictly to your Splunk Cloud outbound public IP addresses. This mitigates key exposure risks while still enabling the add-on to pull data. I believe trial stacks are a single SH so an nslookup/ping should resolve the external IP for you.    🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @sakib  Yes, this is typical behaviour - When indexers track a large number of distinct (host, source, sourcetype, index) combinations within a reporting window that exceeds squash_threshold, Splunk squashes host (h) and source (s) to blank values while preserving sourcetype (st) and index (idx). All high-cardinality traffic for those sourcetypes aggregates under the blank host row, which can easily total 100+ GB or more in a big environment.  Check out https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/license-usage-report-view/about-the-splunk-enterprise-license-usage-report-view#:~:text=Reporting%20Manual.-,Squashing%20fields,-Each%20license%20peer and https://community.splunk.com/t5/Monitoring-Splunk/Wrong-host-license-usage-report-squash-threshold/td-p/758518 for more info too.  If you want to try and work out where the data is coming from then you could look at: index="_internal" source="*license_usage.log" type="Usage" (h="" OR NOT h=*) | stats sum(b) as bytes by idx, st | eval gb = round(bytes/1024/1024/1024, 2) | sort - gb | table idx, st, gb Then use this to look at the index=<idx> sourcetype=<st> as a search to see where the data is coming from. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing.   ... View more

Hi @Magidi  Typically incorrect password 5 times in 5 minutes will trigger an account lockout. This is usually for 30 minutes. Please try again after the cooling off period and see if you can get in. If you’re still having issues I would recommend calling Splunk Support using your local Splunk support contact number (as trial stack won’t give you web support) and explain to them.  for more info check out https://help.splunk.com/en/splunk-cloud-platform/administer/manage-users-and-security/9.3.2408/manage-credentials-and-keys/configure-splunk-password-policies   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing.   ... View more

Hi @rjoijode  Try the following search - replacing the dashboard_1/2 values as required. The cumulative_run_time_sec will give you the total search time for that dashboard in the selected time period - which means if the dashboard is rendered twice then this will show both times.  index=_audit action=search info=completed provenance="UI:Dashboard:*" | eval dashboard_name=case( like(provenance, "%dashboard_1%"), "Dashboard 1 (Multiple Searches)", like(provenance, "%dashboard_2%"), "Dashboard 2 (Base Search)", 1=1, "Other" ) | where dashboard_name!="Other" | stats count as total_search_jobs, sum(total_run_time) as cumulative_run_time_sec, avg(total_run_time) as avg_job_run_time_sec, sum(scan_count) as total_scanned_events, sum(result_count) as total_returned_results by dashboard_name | eval cumulative_run_time_sec=round(cumulative_run_time_sec, 2), avg_job_run_time_sec=round(avg_job_run_time_sec, 2) | table dashboard_name total_search_jobs cumulative_run_time_sec avg_job_run_time_sec total_scanned_events total_returned_results   If you want the *last* invocation you could try: index=_audit action=search info=completed provenance="UI:Dashboard:*" | eval dashboard_name=case( like(provenance, "%dashboard_1%"), "Dashboard 1 (Multiple Searches)", like(provenance, "%dashboard_2%"), "Dashboard 2 (Base Search)", 1=1, "Other" ) | where dashboard_name!="Other" | rex mode=sed field=search_id "s/_\d+\.\d+\'?$//" | dedup search_id | stats count as total_search_jobs, sum(total_run_time) as cumulative_run_time_sec, avg(total_run_time) as avg_job_run_time_sec, sum(scan_count) as total_scanned_events, sum(result_count) as total_returned_results by dashboard_name | eval cumulative_run_time_sec=round(cumulative_run_time_sec, 2), avg_job_run_time_sec=round(avg_job_run_time_sec, 2) | table dashboard_name total_search_jobs cumulative_run_time_sec avg_job_run_time_sec total_scanned_events total_returned_results   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

You could also look at adjusting the index using your Otel configuration - see https://community.splunk.com/t5/Community-Blog/Routing-logs-with-Splunk-OTel-Collector-for-Kubernetes/ba-p/683190#:~:text=Today%20I'll%20show%20you%20how%20to%20create,how%20we%20can%20do%20it%20in%20SOCK. for more info 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @shvra  I would use props/transforms to pivot it based on sourcetype/source/regex (if needed) into a separate index(es) with different retention as required depending on the data, you could also apply other INGEST_EVAL that you need along the way if you need to redact anything or strip certain data out. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @amirahmed  It doesnt look there is an existing Splunkbase app for Informatica logs to be pulled into Splunk, I would suggest looking at using AddOn Builder or UCC Framework to build a custom app to ingest this (typical Python input) or you may be able to use the REST API Modular Input or WebTools Add-On to run curl-type requests with a custom command to poll the data - but creating a custom app would typically be the preferred route. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @prad87  The SignatureDoesNotMatch error with Dell S3-compatible storage could be due to the configuraiton/support of signature versions in the Dell System, I would suggest try setting Splunk to use v2 instead of the default v4 signature. Add the following to your indexes.conf: [volume:remote_store] remote.s3.signature_version = v2 remote.s3.url_version = v1 The url_version = v1 setting must be set when signature_version = v2  Once done restart Splunk. For more info check out indexes.conf - remote.s3.signature_version 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @fedayn05  I would start by using Job inspector  Updating Media livehybrid_1-1786513748709.png     and then clicking on search.log   livehybrid_0-1786513744914.png   Review the output of this to see if there are any glaring errors or issues with the search, feel free to post the contents here but be sure it doesnt contain anything sensitive first. You can also check the _internal index for errors around the time of your search which might get us some indication of what is going wrong, but the above is probably a good starting point.   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing.   ... View more

Hi @0xAli  this sounds like quite a significant data onboarding task. I would start by investigating on Splunkbase for Splunk supported or vendor apps for each system, then work down from there to find community apps for the gaps, then if you find specific gaps then raise those here for the community to comment/answer based on their experiences.    🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @nebilcy  are you referring to Credly badges? If so it usually comes through within a week of certification.    🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @0xAli  These look like benign errors based on Splunk not adding these flags/stanzas to their feature flag spec file...annoying though - which app version of ES is this? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Safia_LSD  You could look at Splunk Certified Cybersecurity Defense Analyst/Architect which are pretty close to the content of the legacy certification you mentioned. The idea is its not specific to Splunk but also some of the terminolofgy/mindset/approach across the industry rather than Splunk specific components. In terms of find it valuable - it still shows that you are capable with the Splunk products and they have a 3 year validity so I think it will be some time until people take a preference of other certs over the legacy ones. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @rheign07  I would recommend speaking to Splunk support about this - given the release date of the last version of Splunk (last week) and this CVE (23rd July) I think its unlikely to have been included.  Please could you share the path of the affected file(s). Also, have you evaluated the impact of this CVE on your service? ie able to apply remediations/risk mitigations? When Splunk deal with CVEs they are typically posted at https://advisory.splunk.com/advisories however this doesnt appear here yet, hence support or perhaps account team would be the best approach. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

HI @_Raj  The term is typically used interchangeably to describe the "SPL" - Splunk Processing Language that is run to produce results. The SPL can be referred to as the query or search, although some users may refer to the SPL as the query and the 'search' being the action/execution of said query.  In terms of Splunk knowledge objects, for example, a 'saved search' is a definition containing a query and other meta/params which when executed returns the results.  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing.   ... View more

Hi @TheBravoSierra  Im not convinced that adding a monitor://...splunkd.log stanza would overwrite the default "monitor://$SPLUNK_HOME/var/log/splunk" which picks up these files usually. Could you try with the following? [monitor://$SPLUNK_HOME/var/log/splunk] _TCP_ROUTING = group2 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @ws  Check out https://splunk.my.site.com/customer/s/article/Agent-Management-page-not-loading-after-Splunk-Enterprise-10-2-upgrade to see if this helps - are you using your DS as other functions like a Monitoring Console by any chance? The details in that link suggest the issue would be solved in 10.2.2 but perhaps it wasnt?! Are there any errors in _internal when you access this page, or are there any web requests with a 500 error in your browser's developer console (network tab)? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Howieson  Can you share the URL its navigating you to please when you get that error? Redact anything sensitive in the URL please. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @pragyas2329  Is this a Splunkbase app? Please could you post a link to it? there’s a chance that the app doesn’t have a UI itself, eg it’s just props/transforms/searches so I would need to check.      🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @kzjbry  This means that the modules that make up the course have no cost (ie Free), however the exam is $130USD. See https://www.splunk.com/en_us/training/certification-track/splunk-core-certified-power-user.html for more info. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more