Hi @saito_lab  The Universal Forwarder does not indefinitely buffer data in memory, you typically have the default maxQueueSize (See https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/configuration-file-reference/9.2.2-configuration-file-reference/outputs.conf#:~:text=false%0A%0A%23%2D%2D%2D%2DQueue%20Settings%2D%2D%2D%2D-,maxQueueSize%20%3D%20%5B,-%3Cinteger%3E%7C%3Cinteger%3E%5BKB ) which is relatively small and is held in memory, not written to disk, therefore setting this value too high can cause an OutOfMemory failure and this, or a restart, would lose the queued content. When the queue fills it will block the various pipelines leading to it and input will stop, if this is a monitor input stanza it will stop reading the files, if its a Splunk2Splunk input then it will stop accepting new data and the client sending the data will start queuing.  If you have a Heavy Forwarder you could look at persistentQueueSize which stores queued data on disk instead of memory.  Regarding Q3 - The UF will automatically reconnect and resume forwarding, for monitor:// inputs, it picks up from the last checkpoint in fishbucket and reads forward through any remaining file data. Q4 - Enable maintenance mode on the indexer cluster before performing restarts. Are you thinking of having all indexers down at one go or performing rolling restarts? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Nrsch  Is there a specific reason they would need to access the generic SHC rather than ES for some searches? If not, and there is capacity, then it would be better for them to just use a single SH/SHC as it is not easy to share knowledge objects between the two.  When working with customers I typically advise that different sets of users use different SH/SHC rather than everyone splitting across multiple SHC, if that makes sense. In terms of 'can they access both' - this depends on how you manage the RBAC and authentication - if you use, for example, the same SAML IdP with the same group mappings then yes they would be able to, but again I would segregate so you have specific groups mappings for specific groups/SHC to alllow you to control this. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @verd4nd1  Create a standard data source with: index=index1 field1="$token1$" field2="$token2$" field3="$token3$" Then create a child search and set the parent as your base search, do this for each custom child search required.   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @_Raj  You could use Windows Event Forwarding although users usually put the UF on the windows host directly. Check out https://community.splunk.com/t5/Getting-Data-In/Windows-Event-Forwarding/td-p/548830 for examples which might help.  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @MikeWilliams1  Please confirm what it is you're trying to achieve?  Is your account in good license health (ie no overs, within license limits and not expired)? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @sfraine  The app only has the following inputs configured: APIActivityAuditEvent AuthActivityAuditEvent AutomatedLeadSummaryEvent CSPMIOAStreamingEvent CSPMSearchStreamingEvent CloudSecurityIOMEvent CorrelationRuleDetectionSummaryEvent CustomerIOCEvent DataProtectionDetectionSummaryEvent DetectionSummaryEvent EppDetectionSummaryEvent FalconActivityAuditEvent FcsIoaDetectionSummaryEvent FirewallMatchEvent HashSpreadingEvent IdentityProtectionEvent IdpDetectionSummaryEvent IncidentSummaryEvent LoginAuditEvent MobileDetectionSummaryEvent ReconNotificationSummaryEvent RemoteResponseSessionEndEvent RemoteResponseSessionStartEvent ScheduledReportNotificationEvent UserActivityAuditEvent XdrDetectionSummaryEvent However there is an 'all' option - out of interest, if you select this do you get the BehavioralRuleDetectionSummaryEvent data? If so you might be able to modify your inputs.conf manually to set this input up with the BehavioralRuleDetectionSummaryEvent data. Alternatively I would recommend opening a support case with CrowdStrike directly as they develop and support this add-on: https://supportportal.crowdstrike.com/ 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

@PickleRick I totally agree, however statements like "UF on Exchange server host but it is not recommended" these days get picked up by google AI results as concrete answers and I'm trying to understand if this is an opinion or something that is a documented recommendation. If an end-client has a preference then that is another matter, but also good to understand the rationale behind these decision as trying to work around them can introduce risks of their own.   ... View more

Hi @AceX  What makes you think its not recommended to install a UF on an exchange server? This is the documented reliable way to get MS Exchange logs into Splunk as per the docs. There is a chance you can access the data through WMI from a separate external host but this introduces further security risks, along with likely incompatibility issues. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @cdCryptoMetrics  As others have said, you cannot send data out of Splunk Cloud in the same way as enterprise.  You might want to look at something such as the "sendtohec Custom Search Command" app which you could run in the search to send the output to the HEC receiver of the on-premise Splunk instance - there are other apps which work similarly but often rely on other ingestion on the receiving end, at least HEC remains Splunk native. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Glasses2  Yes you can do an nlookup of the sh-* name of your search head(s) - Make sure if you have multiple SH in a SHC that you resolve each of them. If for any reason any of your hosts are rebuilt or scaled then its likely your IP(s) will change, its worth speaking to your account team to understand when this might occur as they might be able to put you in touch with the relevant internal teams to discuss further. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Josef  This app is maintained by Databricks themselves, their support email is [email protected] so I would recommend reaching out to them directly to see if they can add this functionality onto their roadmap. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @USA69  This is a Splunk supported addon, therefore I would recommend raising a support case with these details and you should hopefully get this raised directly to the correct team internally. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @adedwiky  Can you double check the mongo/kvstore is healthy? Can you see existing MC findings? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @808antwon  Are you able to confirm that the file at $SPLUNK_HOME/etc/apps/TA-tenable/js/build/ArrowBroadUnderbarDown.75wc1VCJ.js does actually exist or not on the host? If it exists are its permissions correct (ie splunk user can read them). 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @0xAli  What that is essentially saying is if you're on < 7.3.2 you need to upgrade to >=7.3.2 & <8 before upgrading to 8.x If you are on 7.3.4 then you should be fine to go to 8.5.1. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing.   ... View more

Hi @zpadams  The app is supported/maintained by Cofense - I would recommend emailing them at [email protected] to enquire/report this and hopefully they can resolve for you. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @JohnEGones  Why do you have the MC configured on two different instances? You should really consolidate into a single MC and then take it from there. Check out https://help.splunk.com/en/splunk-enterprise/administer/monitor/10.4/configure-the-monitoring-console/which-instance-should-host-the-console for recommended MC setup locations. Once consolidated you can add the SH/HF. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @ALODI  Please could you share the specific logs that you are seeing? Has anything in your environment changed recently? Is this host an all-in-one instance, search head or something else? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @0xAli  The docs for the TA dont mention anything newer (eg 2022) however this is a Splunk supported app therefore I would recommend that you file a support case to query this and if it isnt supported then to get a timeline on when this will be supported. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @MichelMichel  Are you able to check the logs when you do hit that endpoint? What error code are you getting?  Do you get any body content returned from the request?  The issue with non-documented components such as this is that they arent intended to be used outside of the internal Splunk process. If the URL/endpoint has changed in some way it may well be replaced with something different, or behave slightly different (e.g. requires additional field) which Splunk internally might be sending but obviously we dont really know. That being said the url (/shcluster/member/consensus/default/bootstrap) is referenced in $SPLUNK_HOME/etc/system/static/splunkrc_cmds.xml which suggests to me it probably hasnt been removed entirely.  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @kkunkel  Your values.yaml has a configuration key mismatch. You're using kubelet_stats (underscore) but the Splunk OTel Helm chart expects kubeletstats (no underscore) under the receiver configuration path. (See the docs here for more info) This means your metric_groups and metrics overrides are silently ignored, and the receiver runs with defaults Update your agent.config.receivers section:   agent: config: receivers: kubeletstats: # <-- no underscore insecure_skip_verify: true metric_groups: - node - pod - container - volume metrics: k8s.pod.cpu.utilization: enabled: true k8s.node.cpu.utilization: enabled: true k8s.pod.memory.usage: enabled: true k8s.node.memory.usage: enabled: true k8s.pod.cpu.time: enabled: true k8s.node.cpu.time: enabled: true   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Joe_Hartzel  You're certainly in the right place for some Splunk-focussed responses! I would recommend checking out https://help.splunk.com/en/splunk-cloud-platform/splunk-validated-architectures/introduction-to-splunk-validated-architectures/about-splunk-validated-architectures which goes through the Splunk Validated Architecture patterns for implementing Splunk. In terms of logging in general please check https://www.splunk.com/en_us/blog/learn/log-management.html which has a really good walkthrough of various log types and how to use them. Splunk offers a free 500mb trial license for self-hosted Splunk or a 5GB of data/day for 14 days Splunk Cloud trial which you might want to look at to get started.   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @FdataAnalyzer01  By default a power user cannot create an index - have you been given extra capabilities to create the index or was this done via some other means?  Has the index been added to the srchIndexesAllowed either via the UI for your role or appropriate .conf file change? If it hasnt then it may not show up in your dropdown. How have you confirmed that the index now exists? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Raj  As far as I know there isnt a python script to install the botsv3 (which is an archive or buckets) along with the the TA's. I will keep digging and let you know if I do find anything - I saw something similar recently which I cant currently put my finger on so I'll have another look for that. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @sonaralt  You can achieve these with a monitor stanza as @richgalloway  mentioned. For converting xlsx to csv you might get somewhere by looking into the in2csv which is part of csvkit (https://github.com/wireservice/csvkit) and then using the 'unarchive_cmd' flag within a props.conf setting for your sourcetype.  See https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/props.conf#:~:text=unarchive_cmd%20%3D%20%3Cstring%3E for more info This means the file contents would be piped to the cmd in unarchive_cmd and the output would be indexed. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more