Hello @gekardaras  have a look at these pages : https://splunk.my.site.com/customer/s/article/KVStore-upgrade-not-starting-despite and https://community.splunk.com/t5/Splunk-Enterprise/Spike-in-503-errors-in-the-Splunk-WebUI-after-upgrading-to-10-0/m-p/758029  Good luck. ... View more

Hi @chimell1 how did you end up? Did it work? Thanks! ... View more

Hi @Elbald97  please have a look at this : https://splunk.my.site.com/customer/s/article/Deployment-Server-9-4-0-status-is-always-Pending-under-each-Server-Class-Page-Although-the-server-class-apps-already-deployed-to-UF-agents-successfully   Workaround:  Manually reload Deployment server by running the following command from CLI:  splunk reload deploy-server ... View more

Hi @PickleRick  We use /event endpoint, our Kafka expert told me he extracts the “message” field and sends it to our HEC through the connector. Does this mean HEC receives text or json events? He also told me messages are delimited in json, providing source and sourcetype for instance however I understand we don’t control timestamp from Splunk’s side. It’s better than raw endpoint as otherwise he would need to add delimiter on the Vector’s agent source or hardcoded for network logs for example. Thanks. ... View more

Thanks @gcusello  does this mean we need Cisco account or they provide public mail address?   ... View more

Hi @gcusello  no it's Cisco supported so how to contact them? Thanks.   ... View more

Thanks @PickleRick  for your reply, we use Kafka Connect for your information with event endpoint. The most important is HF addons in most case will apply parsing, fields extractions... however looks like timestamp will be controlled by Kafka. ... View more

Hi @livehybrid does this apply to other endpoints like event? Thanks! ... View more

@richgalloway of course, even rebooted, thanks. ... View more

Hi @richgalloway  I can see these errors : "{"level":"FATAL","time":"2026-06-12T14:05:48.105Z","location":"v1/plugin.go:169","message":"error running plugin main method","service":"OpAmp Service","hostname":"splunkserver","error":"workload exit: failed to initialize database client for migrations: failed to establish database connection, max retries exceeded","callstack":"cd.splunkdev.com/libraries/go-teleport-sdk/runtime/v1.Main\n\t/go/pkg/mod/cd.splunkdev.com/libraries/[email protected]/runtime/v1/plugin.go:169\nmain.main\n\t/builds/core-services/opamp-service/sidecar/main.go:264\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:285"} {"level":"INFO","time":"2026-06-12T14:05:49.312Z","location":"sidecar/main.go:138","message":"Package data plane on: 127.0.0.1:26539","service":"OpAmp Service","hostname":"splunkserver"} {"level":"INFO","time":"2026-06-12T14:05:49.314Z","location":"datastore/dbclient.go:94","message":"Initializing database client...","service":"OpAmp Service","hostname":"splunkserver","clientConfig":{"Username":"oas.root","Password":"<redacted>","Host":"localhost","Port":"5432","SslMode":"disable","SslRootCert":"","ConnectTimeout":10,"Name":"opamp_service","ConnectRetries":3,"ConnectRetriesSleep":5,"MaxConnLifetime":30,"MaxIdleConns":4,"MaxOpenConns":4,"AWS":{"ConnectUsingIamRole":false,"IamRoleUsername":""}}} {"level":"INFO","time":"2026-06-12T14:05:49.314Z","location":"datastore/dbclient.go:140","message":"Attempting to establish a connection with the database via user credentials...","service":"OpAmp Service","hostname":"splunkserver","user":"oas.root","connectionString":"host=localhost port=5432 dbname=opamp_service user=oas.root password=<redacted> sslmode=disable sslrootcert= connect_timeout=10","sqlDriver":"postgres"} {"level":"INFO","time":"2026-06-12T14:05:49.314Z","location":"datastore/dbclient.go:170","message":"Checking whether database connection is alive...","service":"OpAmp Service","hostname":"splunkserver"} {"level":"WARN","time":"2026-06-12T14:05:49.317Z","location":"datastore/dbclient.go:175","message":"Failed to verify live connection. Retrying...","service":"OpAmp Service","hostname":"splunkserver","maxRetries":3,"attempt":1} {"level":"WARN","time":"2026-06-12T14:05:54.320Z","location":"datastore/dbclient.go:175","message":"Failed to verify live connection. Retrying...","service":"OpAmp Service","hostname":"splunkserver","maxRetries":3,"attempt":2}" ... 2026-06-12 17:16:49.416 CEST [84794] FATAL: no pg_hba.conf entry for host "127.0.0.1", user "oas.root", database "opamp_service", no encryption   ... View more

Hello @Dpop  @diogofgm  support answered : "The intermediate findings are not listed/visible in the AQ and this is by design. Whilst a column does exist for intermediate findings it is only populated for risk rules and gives a count of intermediate findings that triggered that risk rule" ... View more

Rolling restart of indexers solved. ... View more

Hello @elend  how did you solve it? Did you restart MN or IDX for instance? Thanks! ... View more

@PickleRick reverting to index test works, weird issue. ... View more

The sourcetype appears on the left side with results... when we click on it then no result. ... View more

Yes, just unsupported now? ... View more

Hello @tsa which sourcetype did you set? It doesn't look documented at https://open-docs.neuvector.com/integration/splunk/ Something like neuvector:json? Thanks! ... View more