Hi All, have this dilemma where source counts does not match the count inserted in summary index. sample query that was used -  Base search: index=sample_index | rex mode=sed field=author"s/(\w|\d|[\D\W])/*/g" | eval raw_event=_raw | rex mode=sed field=raw_event"s/(:?author\=[\w|\d|\D\W]+)/author= *********/g" | fields user owner ip mac_address input_file dest_file log_name orig_time orig_sourcetype act category default message message_id raw_mac severity tag vendor product then summary indexing is enabled. runs every 30 minutes that gets past 30 minutes. Validation: if base search is used, for example, it has a result of 100k events. when checked in summary index it has only 50% or less inserted. Note that not all fields are present in all events. example for owner field, it has 3 Values, 17.377% of events.   Question: does it summarize the fields being inserted to the summary index, where it drops the fields with null values? or is that the expected behavior from summary indexing?   Thanks!     ... View more

I am trying to integrate a webhook app to our Splunk Cloud instance to our Microsoft Teams. what other apps can i use besides Microsoft Teams Webhook Alert Connector? Thanks a lot! ... View more

Hi, we are having trouble installing Universal Forwarder (32-bit) to a server that has system specifications of: OS: Windows Server 2008 v6.0 System Model: Virtual Machine CPU: Intel Xeon 3.47GHz Memory: 4Gb It prompts an error message "The minimum Operation system version required to support this installation of Universal Forwarder has not been met" What are actually the minimum server requirements to install a Universal Forwarder? Thanks! ... View more

Minimum requirements for Splunk Universal Forwarder in 32-bit OS If 2x six-core, 2+ GHz CPU, 12GB RAM, RAID 0 or 1+0, with a 64-bit OS installed, is the system requirements different if the server is running in 32-bit OS? ... View more