Hi Team,   We have 2 search head cluster, and few reports scheduled with email action, reports running on one search head is working fine and delivering emails as configured. but another search head is running the report but email is not delivered, I see the following ERROR logs in Inspect job.  04-01-2025 01:00:10.298 ERROR HttpClientRequest [1028078 StatusEnforcerThread] - HTTP client error=Read Timeout while accessing server=https://127.0.0.1:8089 for request=https://127.0.0.1:8089/servicesNS/nobody/botcop/saved/searches/SOMEREPORT/notify. 04-01-2025 01:00:10.299 ERROR SearchNotification [1028078 StatusEnforcerThread] - OnResult notification failed uri=https://127.0.0.1:8089/servicesNS/nobody/botcop/saved/searches/SOMEREPORT/notify postData= method=POST err=Read Timeout status=502 any idea how to fix this? I see the port on SH is listening and accepting connection--tested with telnet.  thanks in advance for any help you may have.   ... View more

We are trying to run the splunk forwarder local to fix few vulnerabilities and getting the following error message and stopped. Can you please help with fix for this?     Dockerfile: FROM splunk/universalforwarder:9:3   Commands run: docker build -t suf . docker run -d -p 9997:9997 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=changeme" --name uf suf     2025-04-01 06:40:50 2025-04-01 06:40:50 TASK [splunk_universal_forwarder : include_tasks] ****************************** 2025-04-01 06:40:50 included: /opt/ansible/roles/splunk_universal_forwarder/tasks/../../../roles/splunk_common/tasks/check_for_required_restarts.yml for localhost 2025-04-01 06:40:50 Tuesday 01 April 2025  13:40:50 +0000 (0:00:00.045)       0:00:19.675 ********* 2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (5 retries left). 2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (4 retries left). 2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (3 retries left). 2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (2 retries left). 2025-04-01 06:41:23 FAILED - RETRYING: [localhost]: Check for required restarts (1 retries left). 2025-04-01 06:41:23 2025-04-01 06:41:23 TASK [splunk_universal_forwarder : Check for required restarts] **************** 2025-04-01 06:41:23 fatal: [localhost]: FAILED! => { 2025-04-01 06:41:23     "attempts": 5, 2025-04-01 06:41:23     "changed": false, 2025-04-01 06:41:23     "changed_when_result": "The conditional check 'restart_required.status == 200' failed. The error was: error while evaluating conditional (restart_required.status == 200): 'dict object' has no attribute 'status'. 'dict object' has no attribute 'status'" 2025-04-01 06:41:23 } 2025-04-01 06:41:23 2025-04-01 06:41:23 MSG: 2025-04-01 06:41:23 2025-04-01 06:41:23 GET/services/messages/restart_required?output_mode=jsonadmin********8089NoneNoneNone[200, 404];;; failed with NO RESPONSE and EXCEP_STR as Not supported URL scheme http+unix 2025-04-01 06:41:23 2025-04-01 06:41:23 PLAY RECAP ********************************************************************* 2025-04-01 06:41:23 localhost                  : ok=68   changed=2    unreachable=0    failed=1    skipped=81   rescued=0    ignored=0   2025-04-01 06:41:23 2025-04-01 06:41:23 Tuesday 01 April 2025  13:41:23 +0000 (0:00:33.184)       0:00:52.859 ********* ... View more

Couple of my CSV indexes in Splunk (UF to Indexers) have been creating/renaming the first field in CSV with special prefixes for example Id is becoming xE2_x81, and ReportID becoming  xE2_x81ReportID or  xE2_x90ReportID, and it is changing to new name automatically after few days. Any help in fixing is appreciated. Thanks in advance.  ... View more

Hi Can someone please guide me how to Schedule PDF Delivery in Splunk dashboard studio.   Thanks in advance. ... View more

Hi There, I need to download the dashboard in PNG file using CLI, is there any way to do this?  Splunk Version: 8.2, Dashboard type:  Dashboard Studio. Thank you in advance for your help. ... View more

Anybody have faced this issue? $ /opt/splunk/bin/splunk add shcluster-member Deserialization failed. Could not find expected key 'current_member_uri' Fresh SH installation, all SH, Master running same version 7.2.0.   Thanks in advance. ... View more

Splunk Enterprise List of jobs in Activity >> Triggered Alerts are visible and the results also can be see by other users who does not have privilege.  Anybody observed this and controlled this for a given user/role?   ... View more

I've singe SPF forwarding to 3 indexers in a cluster, after changing the file permissions to rw from rwx the splunk forwarder stopped indexing files from input dirs. have seen logs no clues found. Any suggestions when to look for errors/exceptions. TIA. ... View more

I need to hide "Settings" in splunk bar on a given App and for a given role. Any suggestions? TIA. ... View more

I need to restrict the user to not to see indexes which are created in a specific App from Search App. Any suggestion how to achieve this? TIA. ... View more

A user with role which does not have read to "Search" app could not access "Account Settings" to change his password. Any idea how to get "Account Settings" without Search app grants? TIA. ... View more

I'm coding dashboard and I'm trying to have js and css which are working fine with single table id, but I want to use the same styles for all tables which have the same class. I do not want to use array of ids in .js and iterate them. Anybody know how how to achieve this? TIA. ... View more

Hello Splunk Developers I need to call a custom command on click of a drilldown on a table cell in dashboard. The action should call the custom command behind the screen and upon completion of command execution should be able to update another cell in the table. Have anybody came across this kind of requirement and able to code the requirement? Any guide/help is appreciated. Thanks in Advance. ... View more