Hi @fedayn05  I would start by using Job inspector  Updating Media     and then clicking on search.log     Review the output of this to see if there are any glaring errors or issues with the search, feel free to post the contents here but be sure it doesnt contain anything sensitive first. You can also check the _internal index for errors around the time of your search which might get us some indication of what is going wrong, but the above is probably a good starting point.   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing.   ... View more

Hi @0xAli  this sounds like quite a significant data onboarding task. I would start by investigating on Splunkbase for Splunk supported or vendor apps for each system, then work down from there to find community apps for the gaps, then if you find specific gaps then raise those here for the community to comment/answer based on their experiences.    🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @nebilcy  are you referring to Credly badges? If so it usually comes through within a week of certification.    🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @0xAli  These look like benign errors based on Splunk not adding these flags/stanzas to their feature flag spec file...annoying though - which app version of ES is this? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Safia_LSD  You could look at Splunk Certified Cybersecurity Defense Analyst/Architect which are pretty close to the content of the legacy certification you mentioned. The idea is its not specific to Splunk but also some of the terminolofgy/mindset/approach across the industry rather than Splunk specific components. In terms of find it valuable - it still shows that you are capable with the Splunk products and they have a 3 year validity so I think it will be some time until people take a preference of other certs over the legacy ones. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @rheign07  I would recommend speaking to Splunk support about this - given the release date of the last version of Splunk (last week) and this CVE (23rd July) I think its unlikely to have been included.  Please could you share the path of the affected file(s). Also, have you evaluated the impact of this CVE on your service? ie able to apply remediations/risk mitigations? When Splunk deal with CVEs they are typically posted at https://advisory.splunk.com/advisories however this doesnt appear here yet, hence support or perhaps account team would be the best approach. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

HI @_Raj  The term is typically used interchangeably to describe the "SPL" - Splunk Processing Language that is run to produce results. The SPL can be referred to as the query or search, although some users may refer to the SPL as the query and the 'search' being the action/execution of said query.  In terms of Splunk knowledge objects, for example, a 'saved search' is a definition containing a query and other meta/params which when executed returns the results.  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing.   ... View more

Hi @TheBravoSierra  Im not convinced that adding a monitor://...splunkd.log stanza would overwrite the default "monitor://$SPLUNK_HOME/var/log/splunk" which picks up these files usually. Could you try with the following? [monitor://$SPLUNK_HOME/var/log/splunk] _TCP_ROUTING = group2 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @ws  Check out https://splunk.my.site.com/customer/s/article/Agent-Management-page-not-loading-after-Splunk-Enterprise-10-2-upgrade to see if this helps - are you using your DS as other functions like a Monitoring Console by any chance? The details in that link suggest the issue would be solved in 10.2.2 but perhaps it wasnt?! Are there any errors in _internal when you access this page, or are there any web requests with a 500 error in your browser's developer console (network tab)? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Howieson  Can you share the URL its navigating you to please when you get that error? Redact anything sensitive in the URL please. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @pragyas2329  Is this a Splunkbase app? Please could you post a link to it? there’s a chance that the app doesn’t have a UI itself, eg it’s just props/transforms/searches so I would need to check.      🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Lynn_01  I think you need to adjust the formatting of your blacklist entry in inputs.conf. Remove the spaces around the inner = characters and the over-escaping of the backslashes. [WinEventLog://Microsoft-Windows-PowerShell/Operational] ... ... blacklist1 = EventCode="4103" Message="C:\\WINDOWS\\CCM\\SystemTemp\\.*\.ps1    🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @vvanlier  Given that this is part of the Enterprise Security app/ecosystem, I would recommend opening a support case with Splunk for them to look into this as its unlikely to be picked up as a community post and we're not able to influence them directly. Once you have raised with Splunk via support they should be able to assign it to the relevant internal team. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Just a follow up on my last reply - Checking the searches that run when I go on the Agent Management page, its using an earliest=1784671702 for me which I *think* could be when I last restarted Splunk (approx 48 hours ago).  If you restart the DS does it stop displaying the offline clients? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Ha Thanks @tscroggins I spent ages trying to make it work with an eval like that but I must have missed something, this is a great viable alternative approach and doesnt need a conditional button too.   ... View more

Hi @masonreed11 @verd4nd1  Please see video demo of the the refresh buttons working: https://youtu.be/CenoIawV8jo  Is this what you are looking to achieve?  🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @xamanium  What errors did you run into when you tried starting Splunk? This would give us a good direction on how to help.  Did you ensure the permissions etc were correct and the files were owned by the correct user? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @verd4nd1  If you create two Refresh buttons which set a different token value each (eg $refresh$=a or $refresh$=b) and then set conditional visibility on them so that it shows the other refresh button when pressed then you can use the $refresh$ token anywhere in your search and it would refresh when the value changes. Ive included example screenshot and code below to try it out:     { "title": "Answers - Refresh button", "description": "", "inputs": { "input_BemUGiQ4": { "containerOptions": { "visibility": { "showConditions": [ "condition_0EKVKhZd", "condition_MRt3Jeks" ] } }, "eventHandlers": [ { "options": { "tokens": [ { "token": "refresh", "value": "a" } ] }, "type": "drilldown.setToken" } ], "options": { "appearance": "destructive", "label": "Refresh" }, "type": "input.button" }, "input_UWjUpoqS": { "containerOptions": { "visibility": { "showConditions": [ "condition_0b7mpx2r", "condition_3PisSwvj" ] } }, "eventHandlers": [ { "options": { "tokens": [ { "token": "refresh", "value": "b" } ] }, "type": "drilldown.setToken" } ], "options": { "appearance": "destructiveSecondary", "label": "Refresh" }, "type": "input.button" }, "input_global_trp": { "options": { "defaultValue": "-24h@h,now", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.o11y": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } }, "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } }, "ds.spl2": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } }, "tokens": { "default": { "refresh": { "value": "a" } } }, "visualizations": { "global": { "showProgressBar": true } } }, "visualizations": { "viz_0yDZeXi0": { "dataSources": { "primary": "ds_jiB3RuM9" }, "eventHandlers": [ { "options": { "tokens": [ { "token": "refreshed", "value": "done" } ] }, "type": "drilldown.setToken" } ], "options": {}, "type": "splunk.table" } }, "dataSources": { "ds_jiB3RuM9": { "name": "Refresher", "options": { "enableSmartSources": true, "query": "| makeresults \n| eval refreshTime=\"$refresh$\"\n| addinfo", "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp", "input_BemUGiQ4", "input_UWjUpoqS" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_0yDZeXi0", "position": { "h": 300, "w": 1090, "x": 0, "y": 0 }, "type": "block" } ], "type": "absolute" } }, "options": {}, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } }, "expressions": { "conditions": { "condition_3PisSwvj": { "name": "refresh2", "value": "$refresh$ = \"a\"" }, "condition_MRt3Jeks": { "name": "refresh1", "value": "$refresh$ = \"b\"" } } } } 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing.    ... View more

Hi @saito_lab  The Universal Forwarder does not indefinitely buffer data in memory, you typically have the default maxQueueSize (See https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/configuration-file-reference/9.2.2-configuration-file-reference/outputs.conf#:~:text=false%0A%0A%23%2D%2D%2D%2DQueue%20Settings%2D%2D%2D%2D-,maxQueueSize%20%3D%20%5B,-%3Cinteger%3E%7C%3Cinteger%3E%5BKB ) which is relatively small and is held in memory, not written to disk, therefore setting this value too high can cause an OutOfMemory failure and this, or a restart, would lose the queued content. When the queue fills it will block the various pipelines leading to it and input will stop, if this is a monitor input stanza it will stop reading the files, if its a Splunk2Splunk input then it will stop accepting new data and the client sending the data will start queuing.  If you have a Heavy Forwarder you could look at persistentQueueSize which stores queued data on disk instead of memory.  Regarding Q3 - The UF will automatically reconnect and resume forwarding, for monitor:// inputs, it picks up from the last checkpoint in fishbucket and reads forward through any remaining file data. Q4 - Enable maintenance mode on the indexer cluster before performing restarts. Are you thinking of having all indexers down at one go or performing rolling restarts? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Hi @Nrsch  Is there a specific reason they would need to access the generic SHC rather than ES for some searches? If not, and there is capacity, then it would be better for them to just use a single SH/SHC as it is not easy to share knowledge objects between the two.  When working with customers I typically advise that different sets of users use different SH/SHC rather than everyone splitting across multiple SHC, if that makes sense. In terms of 'can they access both' - this depends on how you manage the RBAC and authentication - if you use, for example, the same SAML IdP with the same group mappings then yes they would be able to, but again I would segregate so you have specific groups mappings for specific groups/SHC to alllow you to control this. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more