We are running Splunk Enterprise 10.2.3 on prem on Windows 2016 as follows System OS Roles Virtual Comments ServerA Windows 2016 Standard Search Head License Master Cluster Master Deployment Server Yes   ServerB Windows 2016 Standard Search Head KV Store Yes   IndexerA Windows 2016 Standard Indexer No Local Storage for indexes IndexerB Windows 2016 Standard Indexer No Local Storage for indexes   The factors are as follows: Reaplication=2 Search=2 We need to move everything to Windows 2022 or higher. I also wish to avoid  buying  any new physical servers for the indexers. I'm looking for a steer on any caveats or other approaches I coudl take here from somone who's been through this process or something similar.  My thinking is as follows Break down the migration/upgrade as follows Handles Indexers first Move on to other roles Approach for the indexers Option 1 Point all forwarders at a single indexer Backup config of indexer targeted for upgrade Do an in-place windows upgrade of one indexer to Windows 2022. Indexes are on dedciated non-os drive and hence should not be impacted by the OS in-place upgrade If working/stable point all forwarders at this indexer and rinse an repeat for the other one  Option 2 Point all forwarders at a single indexer Backup config of indexer targeted for upgrade Rebuild this indexer with Windows 2022. Indexes are on a separate non-os drive so should be unaffected by upgrade Install Splunk Enterprise Restore indexer config If working/stable point all forwarders at this indexer and rinse and repeat for the other one If all working move on to ServerA which is Search head and KV store Approach for other roles Snapshot VM offline Run in-place windows upgrade Validate configuration If all working move onto cluster master No idea! In-place upgrade seems more risky for this one Note: we have file-based backups of all configurations and indexes ... View more

I have some splunk indexers running on Physical Windows 2016 servers and 4 TB of index data on each (local storage). The replication factor is thus 2 and all infra is healthy.  I need to upgrade to Windows 2019 or later and I'm thinking of and in-place Windows  upgrade on each indexer in turn.   Has anyone done similar in the past and have any caveats/battles scars to share? ... View more

I'm using Splunk Enterprise 9.2.1 on Windows. On my search head a have a bunch of apps (40+) laid out as follows:   /etc/apps/myapp1 /etc/apps/myapp2 /etc/apps/myapp3   Etc. Each app has of course it's own dashboards defined etc. Now i'd like to group all these dashboards under one app and create a menu system for them.  Now I control each app under GIT and can deploy them using a Devops cycle. What I would like to do is create this new app but simply reference the dashboards that reside in the other apps in this new app so that I keep my source/version control. is this possible or would I simlpy have to copy all the dashaboards/views into this new app? ... View more

I'm using Splunk Enterprise 9.1 with Windows Universal Forwarders. I'm ingesting the Windows Domain Contoller netlogon.log file. The Splunk Add-on for Windows has all the parsing/extraction rules defined for me to parse netlogon.log via its sourcetype=MSAD:NT6:Netlogon definition. Now, my use case is that I only wish to retain certain lines from netlogon.log and discard all others. How can I acheive this? Is it a case of defining a new sourcetype and copying the props/transforms from this Splunk_TA_Windows or is there a way to keep using the sourcetype sourcetype=MSAD:NT6:Netlogon and discard the lines via some other mechanism that does not result in my modidying the Splunk_TA_Windows app?  ... View more

I'm using Splunk Enterprise 9 on Windows Server 2019 and monitoring a simple log file that has CRLF lines endings and is encoded as UTF8. My inputs stanza is as follows:   [monitor://c:\windows\debug\test.log] disabled = 0 sourcetype = my_sourcetype index=test   Consider two consectuive lines in the log file   Some data 1 Some data 2   When indexed this creates a single event rather than my expectation of 2 events. Where am I going wrong?     ... View more