Hi as @PickleRick said you can do remove and install a new version and in this case you can go directly from 5.x to 9.x as basically this is a new installation not upgrade. But in this case you will loose the fishbucket db which means that UF don't know what files and in which exact place your UF is going on those files. And this means that you will be reindexing all data again what you have on those nodes online! If/When you want to avoid this, then you must go real update with step by step 6.5 -> 7.x ->.... -> 9.x and always start those UF services before install then next version. When you are starting UF then it do the need conversion for fishbucket etc. Update <=> e.g. yum update splunkforwarder.xxx.rpm remove + install <=> e.g. yum remove splunkforwarder (+ rm -fr /opt/splunkforwarder) + yum install splunkforwarder.xxxx.rpm r. Ismo ... View more

im facing the same problem, no NSG changes was done in any recent. only problem is workload "azureactivedirectory" is not reporting and rest  workloads are pulling results perfectly fine. ... View more

Unfortunately the Splunk App for Unix and Linux does not provide any Monitoring Console level details into your Splunk infrastructure. It's more designed for general Linux information (CPU/Disk/Memory monitoring). Does this other team need full access to the reports, or just some of the information? Most of the graphs can be grabbed by doing an "open in search" at the bottom right of the graph. However, most of the data is in _internal which is by default only visible to admin. You could open that up to others, but then the question is, what are you trying to protect? The data, or the administration of the system? ... View more

I am trying that right now thanks. ... View more

Thank you this helped me accomplish it!! ... View more