Hello @sivakumarm ,  In the Splunk side you need for the Splunk Supporting Add-on for Active Directory the admin_all_objects capability to read storage passwords. The user has this capability by default. If you want to use the add on with the non-admin user, then you must have this capability added to its profile. in the Microsoft side you only need a domain user (enough to discover the Active Directory) You can find all the informations in the official documentation from Splunk for this add-on: Configure the Splunk Supporting Add-on for Active Directory - Splunk Documentation Regards Den ... View more

Hello, You can create a new account with another email and complete de course (30 days) or try to contact Splunk education to reset the F1 course. Americas: education_amer@splunk.com Europe: education_emea@splunk.com Asia/Japan/Australia: education_apac@splunk.com Regards and good luck! ... View more

Hello, Splunk Enterprise and Universal Forwarders must be version 6.6.x or higher to upgrade to version 7.3. List all apps and addons et prepare you step-by-step upgrading plan. Below are the steps to upgrade: First refer: https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/AboutupgradingREADTHISFIRST upgrade Splunk Enterprise to a compatible version. Refer: https://docs.splunk.com/Documentation/Splunk/7.3.1/Installation/HowtoupgradeSplunk Prepare carefully your step-by-step doc, Review, upgrade, and deploy add-ons. Also, read the docs carefully before upgrading. 🙂 ... View more

Hello, When you install DB connect for Splunk , you need first to install and setup the JDBC (Java Database Connectivity database) driver. You need to configure the driver and java into the UI of DB connect on your Splunk instance. In my cases i always use the driver JTDS with windows authentication the other one doesn't work (dont know why) try different drivers maybe. Check this: https://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Installdatabasedrivers#Install_the_SQL_Server_database_driver_using_a_SQL_server_authentication https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Installdatabasedrivers Hope it helps Den ... View more

i contacted the web team and had them fix the link on https://www.splunk.com/en_us/newsroom/media-kit.html. It now takes you to https://www.splunk.com/en_us/newsroom/splunk-stock-photos.html which has logos and other resources. ... View more

Hi check this https://answers.splunk.com/answers/750462/whats-the-order-of-operations-for-upgrading-splunk.html ... View more

Hello, I already had this issue, with a wrong JRE/Driver install. You must install correctly the JRE and the correct drivers on your DB Connect. Which driver are you using with your MSSQL server? and which JRE did you deploy? Check the prerequisites for DB connect. https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Prerequisites In my case i installed this driver https://www.microsoft.com/en-us/download/confirmation.aspx?id=54671 from MS Here is the the steps to install correctly the drivers from the Splunk Docs: https://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Installdatabasedrivers#Install_the_SQL_Server_database_driver_using_a_SQL_server_authentication Hope it helps DM ... View more

Hello yes you can. I use this technique to put my streams in different indexes and manage the permissions. You need to declare the index on your Splunk stream app indexes.conf. to do that follow this steps: 1) On your stream server : SPLUNK_HOME/etc/apps/splunk_app_stream/local 2) edit or create the indexes.conf file 3) declare your indexes (already created on your indexers) like this [yourindex] coldpath = $SPLUNK_DB/yourindex/colddb enableDataIntegrityControl = 0 enableTsdixReduction = 0 homePath = $SPLUNK_DB/yourindex/db MaxTotalDataSizeMB = 512000 #(in my case) thawedPath = $SPLUNK_DB/yourindex/thaweddb 4) restart your splunkd service 5) now when you configure your streams in the stream app you can see your indexes in the dropdown menu Hope it helps ... View more

Hello yes you can. I use this technique to put my streams in different indexes and manage the permissions. You need to declare the index on your Splunk stream app indexes.conf. to do that follow this steps: 1) On your stream server : SPLUNK_HOME/etc/apps/splunk_app_stream/local 2) edit or create the indexes.conf file 3) declare your indexes (already created on your indexers) like this [yourindex] coldpath = $SPLUNK_DB/yourindex/colddb enableDataIntegrityControl = 0 enableTsdixReduction = 0 homePath = $SPLUNK_DB/yourindex/db MaxTotalDataSizeMB = 512000 #(in my case) thawedPath = $SPLUNK_DB/yourindex/thaweddb 4) restart your splunkd service 5) now when you configure your streams in the stream app you can see your indexes in the dropdown menu Hope it helps ... View more