Hi @amara at https://splunkbase.splunk.com/app/3661 not this one https://splunkbase.splunk.com/app/9687 which looks up to date. ... View more

Hi @outcoldman  it says "open file" instead of "finished reading" ... View more

Hi @PickleRick I can see this source in both command outputs. ... View more

Hi @gcusello yes of course through outputs.conf, thanks. ... View more

Hello @Latefa you can check this doc https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.3/threat-intelligence/add-new-threat-intelligence-sources-in-splunk-enterprise-security#f6602b55_45ca_40de_a673_3f4ef9aadb46--en__Add_a_URL-based_intelligence_source ... View more

Hello @Praz_123 you can run these queries from the license manager : index=_* source=*license* | eval mb=round((b/1024),2) | stats sum(mb) as totalkb by h | sort - totalkb | eval totalkb=round(totalkb/1024) | rename totalkb as totalmb You can have also nice chart over days with this: index=_internal source=*license_usage.log type=Usage earliest=-0d@d latest=now | timechart span=15m sum(eval(round(b/1024/1024,2))) AS Total_MB | eval ReportKey="today" | streamstats sum(Total_MB) as cumul | append [search index=_internal source=*license_usage.log type=Usage earliest=-1d@d latest=-0d@d | timechart span=15m sum(eval(round(b/1024/1024,2))) AS Total_MB | eval ReportKey="yesterday" | streamstats sum(Total_MB) as cumul| eval _time=_time+86400 ] | append [search index=_internal source=*license_usage.log type=Usage earliest=-2d@d latest=-1d@d | timechart span=15m sum(eval(round(b/1024/1024,2))) AS Total_MB | eval ReportKey="2 days ago" | streamstats sum(Total_MB) as cumul| eval _time=_time+172800] | append [search index=_internal source=*license_usage.log type=Usage earliest=-3d@d latest=-2d@d | timechart span=15m sum(eval(round(b/1024/1024,2))) AS Total_MB | eval ReportKey="3 days ago" | streamstats sum(Total_MB) as cumul| eval _time=_time+259200] | timechart span=15m avg(cumul) by ReportKey ... View more

Hello @LESMeeks where did you deploy it? There is no need to open configuration page, just put it on HF and SH.  ... View more

Hi @gekardaras what says mongod.log? ... View more

Hi @unluakin could you post screenshot? How did you install the AI toolkit? On SHC? ... View more

Hello @gekardaras  have a look at these pages : https://splunk.my.site.com/customer/s/article/KVStore-upgrade-not-starting-despite and https://community.splunk.com/t5/Splunk-Enterprise/Spike-in-503-errors-in-the-Splunk-WebUI-after-upgrading-to-10-0/m-p/758029  Good luck. ... View more

Hi @chimell1 how did you end up? Did it work? Thanks! ... View more

Hi @Elbald97  please have a look at this : https://splunk.my.site.com/customer/s/article/Deployment-Server-9-4-0-status-is-always-Pending-under-each-Server-Class-Page-Although-the-server-class-apps-already-deployed-to-UF-agents-successfully   Workaround:  Manually reload Deployment server by running the following command from CLI:  splunk reload deploy-server ... View more

Hi @PickleRick  We use /event endpoint, our Kafka expert told me he extracts the “message” field and sends it to our HEC through the connector. Does this mean HEC receives text or json events? He also told me messages are delimited in json, providing source and sourcetype for instance however I understand we don’t control timestamp from Splunk’s side. It’s better than raw endpoint as otherwise he would need to add delimiter on the Vector’s agent source or hardcoded for network logs for example. Thanks. ... View more