Hi, There is a bug in the Splunk Enterprise Installer for 9.1.1 on Windows. During the upgrade (coming from 8.2.8) it processes the dashboard XML files obvisously looking for statments to change during the upgrade. There seems to be an errorneous conversion of UTF8 files when the upgrade process saves them again on Windows and all special characters like äÄöÖüÜ got eliminated and replaced by special characters across all dashboards by the upgrade. We had to manually check all dashboards after the upgrade. Be warned. Regards ... View more

Hi all, Having a strange issue. splunk add oneshot suddenly stops working. I have tried to re-read a file using  splunk add oneshot -source filename.csv -index test -sourcetype mysourcetype -> Oneshot 'filename.csv' added After I deleted the events from index "test". However suddenly events do not appear anymore. Search for with "All Time" scope always returns 0 results. I cannot find any problems in the _internal log for the forwarder. Regards ... View more

Hi all, We have an issue with our environment (all running 8.2.8 currently on Windows Server 2016 Standard). We have a multisite Indexer cluster consisting of 2 Sites with 2 Indexers in each site and a separate 2 node Searchhead cluster, 1 Indexer Master node. Replication is working as expected and when manually taking nodes offline, search and data durability are effected as desired (for ex. if you take a whole site or a single node in a site offline, everything is still searchable). When a configuration bundle is deployed via the Master node, which requires a restart, all indexers in both sites will restart at the same time interrupting all searches. The following values are present in server.conf (using btool) on the Master node: [clustering] percent_peers_to_restart = 10 restart_timeout = 60 rolling_restart = restart rolling_restart_condition = batch_adding replication_factor = 2 site_replication_factor = origin:1,total:2 site_search_factor = origin:1,total:2 On top of that and also unpleasant is that in many cases for ex. when appyling changes to props.conf for existing stanzas via the Master node, the indexers will restart although bundle validation on the Master returned that a restart is not required. According to forum posts the issue should have been fixed in the 6.5.2 release. This environment however was base installed with 7.x so it cannot be an issue which would have been carried along through upgrades. Any thoughts appreciated. Many thanks and regards     ... View more

Hi, I am asking if it's possible to ingest logfiles where one logline would contain a DateTime and the following lines only contain Time, until the next entry with a DateTime. If we ignore Date as a whole by using a custom time DateTime format only consisting of %H:%M:%S it's using the creation date of the file and the time pulled from the individual event. While that works without issues for files containing less than 24 hours it fails for files containing more than 24 hours of data: ### Job STARTED at 2021/09/21 00:30:00 [INFO ] 00:30:01 This is a test message [WARN ] 01:15:01 This is a warning message ### Job STARTED at 2021/09/22 06:10:00 [INFO ] 06:10:01 This is a test message [WARN ] 07:11:00 This is a warning message Regards   ... View more

Hi, Having major issues with Perfmon collection. Values collected for "% Processor Time" (as well as privileged and user) sometimes contain invalid information. Just monitoring a single 6 vCPU machine. While for some processes the CPU usage is correctly returned as percentage value between 0 and 600, other processes every few minutes return values that are way above charts like a few thousand to for ex. like 1.5 Mio. I cannot see any of those numbers while running perfmon. The process IDs of those process also don't change. Regards         ... View more