Hi,   on two Deploymentservers i have the issue, that the KV Store Migration partly failes because the KV Store Version cant be upgraded.   "/opt/splunk/bin/splunk migrate migrate-kvstore" is interupted:    [App Key Value Store migration] Starting migrate-kvstore. [App Key Value Store migration] Checking if migration is needed. Upgrade type 2. This can take up to 600seconds. WARN: [App Key Value Store migration] Service(42) terminated before the service availability check could complete. Exit code 1, waited for 0 seconds. App Key Value Store migration failed, check the migration log for details. After you have addressed the cause of the service failure, run the migration again, otherwise App Key Value Store won’t function.   In Splunkd Logs of the Server you afterwards find the following ERROR Message: 08-24-2022 15:57:45.252 +0200 ERROR KVStoreBulletinBoardManager [4946 MainThread] - Failed to upgrade KV Store to the latest version. KV Store is running an old version, service(40). Resolve upgrade errors and try to upgrade KV Store to the latest version again.   I assume it has something to do with the OS which is SUSE SLES 11.4, since on later RHEL Systems we dont run into the problem. Has somebody experienced the same? ... View more

Hi guys, I'm in GMT+2 timezone and having events from sourcetype=tibco. Based on the event the timestamp format is different: 2019-09-10 12:48:14.066 [blablabla] OR 2019 Sep 10 12:48:10:263 GMT +0200 [blablabla] Actually Splunk displays all events with the first timestamp correctly, events with the second timestamp format are displayed as in future for +2 hours (due to the "GMT +0200"). My question is how to correct this issue. I've tried several things in system/local/props.conf without having success. Does sb have an idea? Thanks in advance and regards Mika ... View more