Hi @livehybrid does this apply to other endpoints like event? Thanks! ... View more

@richgalloway of course, even rebooted, thanks. ... View more

Hi @richgalloway  I can see these errors : "{"level":"FATAL","time":"2026-06-12T14:05:48.105Z","location":"v1/plugin.go:169","message":"error running plugin main method","service":"OpAmp Service","hostname":"splunkserver","error":"workload exit: failed to initialize database client for migrations: failed to establish database connection, max retries exceeded","callstack":"cd.splunkdev.com/libraries/go-teleport-sdk/runtime/v1.Main\n\t/go/pkg/mod/cd.splunkdev.com/libraries/[email protected]/runtime/v1/plugin.go:169\nmain.main\n\t/builds/core-services/opamp-service/sidecar/main.go:264\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:285"} {"level":"INFO","time":"2026-06-12T14:05:49.312Z","location":"sidecar/main.go:138","message":"Package data plane on: 127.0.0.1:26539","service":"OpAmp Service","hostname":"splunkserver"} {"level":"INFO","time":"2026-06-12T14:05:49.314Z","location":"datastore/dbclient.go:94","message":"Initializing database client...","service":"OpAmp Service","hostname":"splunkserver","clientConfig":{"Username":"oas.root","Password":"<redacted>","Host":"localhost","Port":"5432","SslMode":"disable","SslRootCert":"","ConnectTimeout":10,"Name":"opamp_service","ConnectRetries":3,"ConnectRetriesSleep":5,"MaxConnLifetime":30,"MaxIdleConns":4,"MaxOpenConns":4,"AWS":{"ConnectUsingIamRole":false,"IamRoleUsername":""}}} {"level":"INFO","time":"2026-06-12T14:05:49.314Z","location":"datastore/dbclient.go:140","message":"Attempting to establish a connection with the database via user credentials...","service":"OpAmp Service","hostname":"splunkserver","user":"oas.root","connectionString":"host=localhost port=5432 dbname=opamp_service user=oas.root password=<redacted> sslmode=disable sslrootcert= connect_timeout=10","sqlDriver":"postgres"} {"level":"INFO","time":"2026-06-12T14:05:49.314Z","location":"datastore/dbclient.go:170","message":"Checking whether database connection is alive...","service":"OpAmp Service","hostname":"splunkserver"} {"level":"WARN","time":"2026-06-12T14:05:49.317Z","location":"datastore/dbclient.go:175","message":"Failed to verify live connection. Retrying...","service":"OpAmp Service","hostname":"splunkserver","maxRetries":3,"attempt":1} {"level":"WARN","time":"2026-06-12T14:05:54.320Z","location":"datastore/dbclient.go:175","message":"Failed to verify live connection. Retrying...","service":"OpAmp Service","hostname":"splunkserver","maxRetries":3,"attempt":2}" ... 2026-06-12 17:16:49.416 CEST [84794] FATAL: no pg_hba.conf entry for host "127.0.0.1", user "oas.root", database "opamp_service", no encryption   ... View more

Hello @Dpop  @diogofgm  support answered : "The intermediate findings are not listed/visible in the AQ and this is by design. Whilst a column does exist for intermediate findings it is only populated for risk rules and gives a count of intermediate findings that triggered that risk rule" ... View more

Rolling restart of indexers solved. ... View more

Hello @elend  how did you solve it? Did you restart MN or IDX for instance? Thanks! ... View more

@PickleRick reverting to index test works, weird issue. ... View more

The sourcetype appears on the left side with results... when we click on it then no result. ... View more

Yes, just unsupported now? ... View more

Hello @tsa which sourcetype did you set? It doesn't look documented at https://open-docs.neuvector.com/integration/splunk/ Something like neuvector:json? Thanks! ... View more

solved by restarting the SHC member. ... View more

Hi @woodcock got this warning after network issues yesterday, applied https://splunk.my.site.com/customer/s/article/The-number-of-extremely-lagged-searches-X-over-the-last-hour-exceeded-the-red-threshold-X-on-this-Splunk-instance but could not find any lagged search. Either wait to be cleared or maybe will need restart of the impacted SHC member... ... View more

Hello @bowesmana had some errors, this way is more reliable but from ssh : find /OPT/splunk/etc/apps -type f -path "*/lookups/*" -exec du -h {} \; | sort -h ... View more

Hello @kknairr thanks for detailed explanation, especially sslRootCAPath, no need to put all rootCAs in single file but in the directory then? ... View more

Hello @PickleRick thanks, do you mean using sslRootCAPath? By default ssl verify is disabled so is it necessary? Thanks. ... View more