Hi Team, Earlier we had the Splunk Fundamental Courses 1, 2 & 3 so it would be really useful for the beginners to learn from the Scratch but unfortunately I couldn't able to find the course available for now.  So do we have any other course or topics which covers the basic stuffs for the beginners similar like Splunk Fundamental Courses 1, 2 & 3 so if it is yes, Then kindly share the details of the course and also let me know whether its a paid or free course. Thank you. ... View more

Hi Team,   Recently we got an requirement from our internal teams to ingest the Active Directory logs into Splunk.  Hence our Cluster Master, Search Heads & Indexers are hosted in Cloud and managed by Support.  Hence I have downloaded the add-on "Splunk Supporting Add-on for Active Directory" and installed in my Heavy Forwarder server and performed the configurations as mentioned in the Add-On. i.e. Domain name : xyz Alternate domain name : xyz Base DN : xyz LDAP Server Hostname : xyz Port : 389 SSL : I didnt enable the check box. Credentials Bind DN : Provided my admin account information Password : Related Password Connection Status : Test Succeeded When clicked Save its not showing up as Saved.  Similarly we have installed the Add-On in our Search Heads as well but didn't perform any configurations since its in Cloud. So post doing it when I went to search head and try to search the below queries as provided in the Add-on I am not getting the desired results else we are getting the error as below.   Search Query : | ldaptestconnection domain="xyz" Getting error as below : External search command 'ldaptestconnection' returned error code 1. Script output = "error_message=Cannot find the configuration stanza for domain=xyz in ldap.conf. ".   Search Query : | ldapsearch search="(objectClass=group)" attrs=distinguishedName | ldapgroup Getting error as below : External search command 'ldapsearch' returned error code 1. Script output = "error_message=Missing required value for alternatedomain in ldap/default. ". So is that anything missed in the configuration and why I am getting this error so kindly help on how to get it fixed. Is anything i need to change in the configuration page which is installed in the Heavy Forwarder kindly let me know.       ... View more

Hi Team, I need some help to pull the top 10 index utilization (on an average of last 7 days) in a dashboard representation which should not include internal indexes and it should be in GB so kindly help out with the search query. And also similarly I need the Splunk License Usage by Host and Sourcetype in a Dashboard view (Last 7 days average data) in GB.   So kindly help out on the same. ... View more

Hi Team, I have downloaded the 9.0.3 UF version Windows 64 bit and installed the Splunk UF in my Microsoft Windows server 2016 Data Center and started the services. Post which when i have try to check the Splunk status or do a restart of Splunk UF i am getting an warning message as below in the cmd prompt. So how to overcome this one. Warning: overriding %SPLUNK_HOME% setting in environment ("C:\Program Files\SplunkUniversalForwarder\bin\") with "C:\Program Files\SplunkUniversalForwarder". If this is not correct, edit C:\Program Files\SplunkUniversalForwarder\etc\splunk-launch.conf   When i checked the Splunk-launch.conf file i can see as below: # SPLUNK_HOME=C:\Program Files\SplunkUniversalForwarder   And when i hit the %SPLUNK_HOME% in run it directly navigating to below directory  C:\Program Files\SplunkUniversalForwarder\bin And when i checked the environment variables i can see SPLUNK_HOME as been set as C:\Program Files\SplunkUniversalForwarder\bin sohow to get rid of warning. ... View more