Every bucket has to store every dimension value once, so if you are using a million unique IDs to reference combinations of less than a million unique dimension strings, you are making the situation worse. Using KV Store is a great idea for repetitive asset information, like adding context to a hostname, but in this situation you should still store the meaningful unique identifier (hostname) as a dimension. I believe your best solution will be some combination of dimensions and KV Store to enrich them, but don't go 100% in either direction, and if you start creating new unique keys to make it work I think it's going too far. The only other suggestion I have is if you have large logic groups of systems without overlapping dimensions, you could put them into separate indexes and use wildcards in your index filter to access them all. Will keep the TSIDX smaller and performance higher. ... View more

I just built an app to do this: https://splunkbase.splunk.com/app/7371 ... View more

As I said on Reddit, you should take a look at Mothership. https://splunkbase.splunk.com/app/4646  ... View more

FYI there are no index time field extractions on mode=multikv There are on mode=single but they are for metric store. ... View more

Thanks for the mention. This person definitely needs to watch my conf talk. https://conf.splunk.com/files/2023/recordings/PLA1163C.mp4 ... View more

The developer appears to be using the wrong REST URL It should be splunkd/__raw/services/TA-ServiceNow-SecOps_Setup I would report this to [email protected] ... View more

I am having the same issue and can point you in the right direction. If you are logged in as the Splunk user, it seems you get that error whenever you try run node. You can confirm this by running "which node" and you will see it's Splunk's. The workaround I'm using, is I develop my Splunk UI app as another OS user where node works. I also just created the symlink manually because my environment is a little different.   ... View more

Yes, once you upload it to Splunkbase it will run through AppInspect, however you do not need to pass to get on Splunkbase! I have a published app which cannot pass AppInspect for example. A human will review your app just to check it doesn't have malware etc. You can also run AppInspect yourself by API. See more details at https://dev.splunk.com/enterprise/docs/developapps/testvalidate/appinspect/  ... View more

If your app has no python code in it, I don't see why you should be trying to run the Python Upgrade Readiness against it, as it has nothing to check. A "fail" makes sense in the context that the check failed, but not that you app has failed to work with Python 3. I cannot see any reason why your app wouldn't work with Python 3, because it has no Python to begin with. If you want to be sure, I would just run and test your app on the latest Splunk 8.2 version. ... View more

You most likely want to use either msiexec.exe /i splunkuniversalforwarder.msi RECEIVING_INDEXER=[indexerhostname]:9997 AGREETOLICENSE=yes /quiet or if you have a deployment server, then use: msiexec.exe /i splunkuniversalforwarder.msi DEPLOYMENT_SERVER=[deploymentserverhostname]:8089 AGREETOLICENSE=yes /quiet If you do not include the agreetolicense, it will not work unattended. ... View more