This worked for me on version 8.x recently. Thanks. ... View more

Hello @Roy_9 , I had this issue too when accessing dashboards created on Dashboard Studio. The solution was to create a ticket on Splunk Support to be applied a fix on the Search Heads and a restart of the splunkd process.   Thanks. ... View more

Hello @mcscjlf , You could try something like that (assuming that you want to see this data in search-time): | rex mode=sed field=_raw "s/(\S+)(tx_\S+)(\/\S+)/\1trans\3/g"   You can change the field=_raw to your specific field, if it is being extracted already in a field. ... View more

Hello @Gregski11 , This message is related to jQuery 3.5 upgrade. More details on this docs: https://docs.splunk.com/Documentation/UpgradejQuery/1/UpgradejQuery/jQueryOverview "If you encounter an issue with jQuery in a Simple XML dashboard that you own, update your custom JavaScript to work with jQuery 3.5, and certify that the dashboard works with jQuery 3.5 by adding version="1.1" to the root node of the dashboard source code. "   ... View more

Hello @leejones4 , You could use the sourcetype definition instead of the sources on the props.conf file For example: props.conf file [meraki] <YOUR_DEFINITIONS_HERE> ... View more

Hello @cbiraris , Which version of Splunk are you using? Are you using Dashboard Studio or Classic Dashboard? Could you please share examples of modifications that are not showing on different browsers (is this only splunk configurations or some custom code using javascript, for example)?   Thanks. ... View more

As @richgalloway said, you probably will want the Victoria Experience. For more details about the differences you could reference for the following: link: https://docs.splunk.com/Documentation/SplunkCloud/latest/Admin/Experience   ... View more

Hello @SplunkAdmin69 , Sorry, I am not familiar with this tutorial, is this a public Splunk tutorial? If yes, could you please post the link of this tutorial? In the first case, if the data is not being shown now you would need to verify: 1) if the role of the user that is searching the data have permissions to search this index. 2) The retention size/time of the index (if the retention is exceeded, this data will be deleted). For the second case, could you please share the complete query? Thanks. ... View more

Hello @thos13 , It is recommended to follow the official Splunk ITSI docs, you can refer to the following: - https://docs.splunk.com/Documentation/ITSI   Also, it is recommended to verify the blueprint of the ITSI exam, with all the relevant informations: - https://www.splunk.com/pdfs/training/Splunk-Test-Blueprint-ITSI-Admin-v1.1.pdf     ... View more

Hello, It is missing a \ after the name and before the ". The correct one is: | rex mode=sed "s/\"name\":\s\"[^\"]+\"/"name":"###############"/g" ... View more

Hello @an , You could do the following to troubleshoot this issue: 1 - Download the Universal Forwarder app from your Splunk Cloud trial instance and install it on /opt/splunkforwarder/etc/apps (If you not already installed this app). 2 - Verify the permissions of the files that you added on the monitor path (if the user that is running Splunk can read/execute these files). 3 - Verify if the monitor configs are correct and an index is being defined on the monitor stanza. 4 - Run splunk btool check command to check for any typos on .conf files. 5 - Restart the Universal Forwarder (The changes on the Universal Forwarder are only applied after a restart). 6 - Search for index=_internal host=<your_uf_host> on Splunk Cloud trial to verify if internal logs are being indexed. If the internal logs are being indexed, search for the index that you configured your monitor on the step 3. 6.1 - If there are internal logs from your instance but there are no logs on your index, there is an error on the configs of this input. 6.2 - If there are no internal logs, the error could be related to a firewall issue that you could try to troubleshoot on the UF log files (search for an error that shows that you cannot connect to the Splunk Cloud): cat /opt/splunkforwarder/var/log/splunk/splunkd.log | grep -i ERROR   Thanks. ... View more

Hello @Gregski11 , The role that you are saying is the Monitoring Console role or the Deployment Server actually acting as a Search Head? In the first case, only the Search Heads should have the Search Head role. In the second case, it is not recommended because if the DS have many clients phoning home, searches could overwhelm this instance.   Thanks. ... View more

Hello, To use a Heavy Forwarder as an intermediate tier, you should listen to the port that the data is being sent from the UF/HF (usually 9997) and configure the correct outputs to the Indexer tier. The first HF should also have the outputs configured to the second HF and the Indexer tier should listen to the inputs port (9997) too. Also, the data is not indexed on the second HF, only on the Indexing tier the data is indexed.   Thanks.   ... View more

Hello @madhukar3us , Could you please provide more information? Are these values on the same field? Could you also share some log samples?   Thanks. ... View more

Hello @krishnabv , which endpoint are you using to create these ports on Splunk Cloud? It should not be allowed to create TCP/UDP inputs on Splunk Cloud since it only accepts connections from forwarders that have the correct SSL certificates and if you want to send data via TCP/UDP sources you should use a forwarder. ... View more