Hi Team, We are planning to upgrade the Splunk Enterprise instances running on our Deployment Master and Splunk Heavy Forwarder servers to the latest supported version. Please find the current environment details below for your reference. Could you kindly review and confirm whether we can directly upgrade to Splunk Enterprise version 10.4.2, or if there are any intermediate versions that need to be upgraded first before proceeding to 10.4.2? Your guidance on the recommended upgrade path would be greatly appreciated.   1.)Splunk Deployment Master server Current Version : Splunk 9.3.1 (build 0b8d769cb912) Planning to upgrade to 10.4.2 version Configuration Specs:  nproc 4 free -h                 total        used        free      shared  buff/cache   available Mem:            15Gi       2.4Gi       1.1Gi       3.0Mi        12Gi        13Gi Swap:            9Gi       147Mi       9.9Gi  uname -r 5.14.0-687.17.1.el9_8.x86_64 cat /etc/os-release NAME="Red Hat Enterprise Linux" VERSION="9.8 (Plow)"   ====================================================================== 2.) Heavy Forwarder 1:  Current Version : Splunk 9.3.1 (build 0b8d769cb912) Planning to upgrade to 10.4.2 version Configuration Specs:  nproc 2 free -h                 total        used        free      shared  buff/cache   available Mem:           7.5Gi       1.8Gi       387Mi       4.0Mi       5.5Gi       5.7Gi Swap:            9Gi       273Mi       9.7Gi  uname -r 5.14.0-687.17.1.el9_8.x86_64 cat /etc/os-release NAME="Red Hat Enterprise Linux" VERSION="9.8 (Plow)"   ============================================================================= 3.) Heavy Forwarder 2:   Current Version : Splunk 9.2.2 (build d76edf6f0a15) Planning to upgrade to 10.4.2 version Configuration Specs:  nproc 2 free -h                 total        used        free      shared  buff/cache   available Mem:           7.5Gi       1.8Gi       187Mi       3.0Mi       5.6Gi       5.7Gi Swap:            9Gi       310Mi       9.7Gi  uname -r 5.14.0-687.17.1.el9_8.x86_64 cat /etc/os-release NAME="Red Hat Enterprise Linux" VERSION="9.8 (Plow)" ... View more

Hi All, We initially received a requirement to configure and ingest logs from Azure Storage Blob. To address this, we installed the Splunk Add-On for Microsoft Cloud Services on our Heavy Forwarder servers and configured it to pull logs from Azure Storage Blob using the Azure Storage Account. Currently, there's a new requirement to ingest Databricks logs from Azure Storage Blob. We completed the necessary configurations and set the default sourcetype to mscs:storage:blob for data parsing. While the events are visible in Splunk after the configuration, we noticed that the data parsing is not functioning as expected for these events. As a troubleshooting step, I changed the sourcetype to mscs:storage:blob:json, but the issue still persists. Could you please assist me in resolving this issue? Your guidance would be greatly appreciated.   ... View more

Hi Team, We are planning to host the Deployment Master server and two Splunk Heavy Forwarder servers in our on-prem Nutanix environment. Could you please provide the recommended hardware requirements for hosting these servers? Based on your input, we will plan and provision the necessary hardware. The primary role of the Deployment Master server will be to create custom apps and collect data from client machines using Splunk Universal Forwarder. For the Heavy Forwarders, we will be installing multiple add-ons to configure and fetch data from sources such as Azure Storage (Table, Blob), O365 applications, Splunk DB Connect, Qualys, AWS, and client machine data parsing. We are looking for the minimum, moderate, and maximum hardware requirements as recommended by Splunk Support to host the Splunk DM and HF servers in the Nutanix environment. If there are any support articles or documentation available, that would be greatly appreciated. Thank you! ... View more

Hi All, We previously used the Splunk Add-on for Microsoft Office 365 Reporting Web Service (https://splunkbase.splunk.com/app/3720) to collect message trace logs in Splunk.   However, since this add-on has been archived, what is the recommended alternative for collecting message trace logs now? ... View more

Hi Team, We have recently started ingesting Apache access and request logs from an application, but the data parsing isn't working as expected. Could you please let me know the field names for these events so I can try to extract them manually? Alternatively, do we have any format or add-on available that would enable automatic field extraction? If so, that would also be fine with me. For your information, our Splunk Search Head is hosted in the cloud and managed by Splunk Support. I have provided the log structure for both log sources for reference. Please help to check and update.   Request Logs: [09/Aug/2024:07:50:37 +0000] xx.yyy.zzz.aa TLSv1.2 ABCDE-FGH-IJK256-LMN-SHA123 "GET /share/page/ HTTP/1.1" xxxxx [09/Aug/2024:07:50:37 +0000] xx.yyy.zzz.aa TLSv1.2 xxxxx-xxx-xxx256-xxx-xxx123 "GET /share/page/ HTTP/1.1" - Access Logs: xx.yyy.zzz.aa - - [09/Aug/2024:07:57:00 +0000] "GET /share/page/ HTTP/1.1" 200 xxxxx aaa.bbb.ccc.dd - - [09/Aug/2024:07:56:53 +0000] "GET /share/page/ HTTP/1.1" 200 - Thank you. ... View more

Hi Team, Our Splunk environment, including Search Heads, Indexers, and CM, is hosted in the cloud and managed by Splunk Support. We manage our Deployment Master and Heavy Forwarder servers, which are hosted in Azure. We are ingesting logs from both Windows and Linux servers via Splunk Universal Forwarder. For some time, we have been ingesting IIS logs from all Windows machines, defining the sourcetype based on the application and environment. For instance, logs from an application server named "xyz" have a sourcetype of "xyz:iis:prod." However, our internal SOC team has identified that data parsing for these IIS logs is not occurring, and it needs to be addressed immediately without changing the host or sourcetype information. Currently, when the sourcetype is set to "iis," fields are auto-extracted, but when a different sourcetype is used, field extraction does not happen. I need to ensure that field extraction for Microsoft IIS logs works correctly while keeping the sourcetype unchanged. How can this be achieved? ... View more

Need to pull the License Usage in GB for the top 100 Host along with their respective Index Source and Souretype information on monthly basis for reports. So kindly help with the query.  ... View more

Hi Team,   We have deployed Splunk Cloud in our environment and currently have a requirement to generate monthly report statistics separately based on Index, Host, Source, and Sourcetype. Could you please provide the queries to pull the required statistics in Splunk? We need separate reports for the top 10 in GB, excluding internal indexes and their sourcetypes. Your assistance with the query is much appreciated.         ... View more

Hi Team, There is a requirement  to get the license usage split in GB on daily basis for the top 20 log sources along with the host, index and sourcetype details.  So kindly help with the query. ... View more