Hello @sivakumarm ,  In the Splunk side you need for the Splunk Supporting Add-on for Active Directory the admin_all_objects capability to read storage passwords. The user has this capability by default. If you want to use the add on with the non-admin user, then you must have this capability added to its profile. in the Microsoft side you only need a domain user (enough to discover the Active Directory) You can find all the informations in the official documentation from Splunk for this add-on: Configure the Splunk Supporting Add-on for Active Directory - Splunk Documentation Regards Den ... View more

Hello, You can create a new account with another email and complete de course (30 days) or try to contact Splunk education to reset the F1 course. Americas: education_amer@splunk.com Europe: education_emea@splunk.com Asia/Japan/Australia: education_apac@splunk.com Regards and good luck! ... View more

Hello yes you can. I use this technique to put my streams in different indexes and manage the permissions. You need to declare the index on your Splunk stream app indexes.conf. to do that follow this steps: 1) On your stream server : SPLUNK_HOME/etc/apps/splunk_app_stream/local 2) edit or create the indexes.conf file 3) declare your indexes (already created on your indexers) like this [yourindex] coldpath = $SPLUNK_DB/yourindex/colddb enableDataIntegrityControl = 0 enableTsdixReduction = 0 homePath = $SPLUNK_DB/yourindex/db MaxTotalDataSizeMB = 512000 #(in my case) thawedPath = $SPLUNK_DB/yourindex/thaweddb 4) restart your splunkd service 5) now when you configure your streams in the stream app you can see your indexes in the dropdown menu Hope it helps ... View more

Hello yes you can. I use this technique to put my streams in different indexes and manage the permissions. You need to declare the index on your Splunk stream app indexes.conf. to do that follow this steps: 1) On your stream server : SPLUNK_HOME/etc/apps/splunk_app_stream/local 2) edit or create the indexes.conf file 3) declare your indexes (already created on your indexers) like this [yourindex] coldpath = $SPLUNK_DB/yourindex/colddb enableDataIntegrityControl = 0 enableTsdixReduction = 0 homePath = $SPLUNK_DB/yourindex/db MaxTotalDataSizeMB = 512000 #(in my case) thawedPath = $SPLUNK_DB/yourindex/thaweddb 4) restart your splunkd service 5) now when you configure your streams in the stream app you can see your indexes in the dropdown menu Hope it helps ... View more

Hello, No mention about Search Head cluster support in the doc from Crowdstrike. If you have a test environment you can test it. But i'm sure it's working on search head cluster, i have many apps in production with no mention for shc and it works perfectly. Try to push the app with your deployer to the shc member (be careful to remove the inputs.conf file on the Search heads) Refer to: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchanges This app is supported by crowdstrike regarding to Splunk Base, you can ask directly to: integrations(at)crowdstrike(dot)com Hope it helps, ... View more

Hello, Splunk Enterprise and Universal Forwarders must be version 6.6.x or higher to upgrade to version 7.3. List all apps and addons et prepare you step-by-step upgrading plan. Below are the steps to upgrade: First refer: https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/AboutupgradingREADTHISFIRST upgrade Splunk Enterprise to a compatible version. Refer: https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/HowtoupgradeSplunk Prepare carefully your step-by-step doc, Review, upgrade, and deploy add-ons. Also, read the docs carefully before upgrading. 🙂 ... View more

Hello, When you install DB connect for Splunk , you need first to install and setup the JDBC (Java Database Connectivity database) driver. You need to configure the driver and java into the UI of DB connect on your Splunk instance. In my cases i always use the driver JTDS with windows authentication the other one doesn't work (dont know why) try different drivers maybe. Check this: https://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Installdatabasedrivers#Install_the_SQL_Server_database_driver_using_a_SQL_server_authentication https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Installdatabasedrivers Hope it helps Den ... View more

Hello, I already had this issue, with a wrong JRE/Driver install. You must install correctly the JRE and the correct drivers on your DB Connect. Which driver are you using with your MSSQL server? and which JRE did you deploy? Check the prerequisites for DB connect. https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Prerequisites In my case i installed this driver https://www.microsoft.com/en-us/download/confirmation.aspx?id=54671 from MS Here is the the steps to install correctly the drivers from the Splunk Docs: https://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Installdatabasedrivers#Install_the_SQL_Server_database_driver_using_a_SQL_server_authentication Hope it helps DM ... View more

Hello, You can ask directly Splunk if you can have the Media Kit (logos and images). Check the press corner and media kit pages. If you have an Account manager you can ask for some presentation kit (like the cheatsheats for Splunk). Here you have the pdf of the quick ref: https://www.splunk.com/pdfs/solution-guides/splunk-quick-reference-guide.pdf https://www.splunk.com/en_us/newsroom/press-releases.html Hope it helps. ... View more

Hello, Yes i think it's and good idea to upgrade asap, you could directly upgrade to 7.3. Before doing the upgrade backup all you apps (or deployement server) and the critical conf files (/etc/system of all your splunk instances). Prepare carefully the upgrade, check the compability matrix/release notes of the critical apps used in your infra and check if it's supported or if you need an upgrade too. Upgrading Splunk it's not the biggest work i think your case, upgrading all your apps need a good preparation. My advice, Create a document with all your apps/version, servers, and prepare your upgrade. https://docs.splunk.com/Documentation/Splunk/7.3.0/Capacity/Referencehardware This documents will help you too: (read carefully the first one) https://docs.splunk.com/Documentation/Splunk/7.3.0/Installation/AboutupgradingREADTHISFIRST https://docs.splunk.com/Documentation/Splunk/7.3.0/Installation/UpgradeonUNIX ... View more