Hello @williamcclark , Is this a Splunk Cloud or on-premise instance? If it is Splunk Cloud and it is a Classic stack confirm if this app is installed in IDM instead of the SH. Also, I recommend you the following: 1 - Open the developer tools of your browser and go to the Console to see if there any errors shown when you receive this error message. 2 - Look for internal errors of this TA in Splunk. index=_internal source=*tenable*   Thanks. ... View more

Hello @MihaiGheorghita , You can restore access to older jQuery libraries on the following path:  Go to your Search Head and then: - In the Search & Reporting app, select Settings > Server Settings, and then select Internal Library Settings >  toggle the jQuery Libraries older than 3.5 section to restrict/unrestrict older jQuery libraries. Doc: https://docs.splunk.com/Documentation/UpgradejQuery/1/UpgradejQuery/LibrarySettings#Restrict_access_to_older_versions_of_jQuery Thanks. ... View more

Hello @phanikumarcs , For a Classic Dashboard, click on "Edit > Source" and add the following after the </search> tag and inside <chart> tag:   <option name="charting.axisLabelsX.majorLabelVisibility">hide</option>   This configuration will hide the labels from the X axis. Thanks. ... View more

Hello @Alan_Chan , Could you please share the configuration of the inputs.conf file for the WinHostMon://Service input? Please make sure that the disabled=0 is configured for this input and also that a restart in the splunk service was done after the changes on the inputs.conf file. Also, it is recommended to execute a btool command to make sure that this configuration is with the correct precedence: splunk btool inputs list --debug Thanks. ... View more

Hello @WumboJumbo675 , If there are no errors in the connection between UFs > HFs > Splunk Cloud, there are no syntax errors, the index is created and the precedente of the inputs is correct I believe that a reboot is a good option. Thanks. ... View more

Hello @kenbaugher , The ulimit -d configuration will only present the current ulimit configuration.  Please use the following Splunk doc to apply the ulimits configuration: https://docs.splunk.com/Documentation/Splunk/9.2.0/Troubleshooting/ulimitErrors#Set_limits_using_.2Fetc.2Fsecurity.2Flimits.conf  Thanks. ... View more

Hello @jamesbanday , The message "is not a known identity" is related to the Identities that are configured in the Splunk Enterprise Security, probably this user is not configured in the Identities lookup. To configure Assets & Identities in Splunk Enterprise Security, use the following doc: https://docs.splunk.com/Documentation/ES/7.3.0/Admin/Addassetandidentitydata. Also, you could check in Splunk if this identity exists using the identities macro:   | `identities` | search identity=<NAME_IDENTITY>   Thanks. ... View more

Hello @WumboJumbo675 , 1 - Confirm in Splunk Cloud if the internal logs from Heavy Forwarder are being indexed (I believe yes, since you said some logs are correct). If yes, the issue is between UFs > HFs communication. index=_internal host=<host_name_heavy_forwarder> 2 - Confirm if the communication between UFs and HFs is working correctly. Look for ERROR messages or tcpout error messages in the UFs:  $SPLUNK_HOME/var/log/splunk/splunkd.log  3 - Execute a btool check to confirm if there are no syntax errors on the .conf files on UFs: splunk btool check 4 - Check the precedence of the inputs.conf files using btool to confirm that the inputs are being read: splunk btool inputs list --debug 5 - Confirm if there is a "wineventlog" index created in Splunk Cloud.   Let me know if this helps. Thanks. ... View more

Hello @phanikumarcs , The spath command is duplicating the values of this event. Please try the following not using the spath command: index=myindex sourcetype=mysourcetype | table analytics{}.destination, analytics{}.messages, analytics{}.inflightMessages   Thanks. ... View more

Hello @maede_yavari , Splunk Enterprise 9.2.0.1 was released today (on February 8, 2024).  Thanks. ... View more

Hello @lhillscu , Your query seems correct. Could you please confirm that these 2 fields really exists in the last query? Since these 2 fields were not referenced in the "API Search" example. message.id message.payload   Thanks.     ... View more

This worked for me on version 8.x recently. Thanks. ... View more

Hello @Roy_9 , I had this issue too when accessing dashboards created on Dashboard Studio. The solution was to create a ticket on Splunk Support to be applied a fix on the Search Heads and a restart of the splunkd process.   Thanks. ... View more

Hello @mcscjlf , You could try something like that (assuming that you want to see this data in search-time): | rex mode=sed field=_raw "s/(\S+)(tx_\S+)(\/\S+)/\1trans\3/g"   You can change the field=_raw to your specific field, if it is being extracted already in a field. ... View more

Hello @Gregski11 , This message is related to jQuery 3.5 upgrade. More details on this docs: https://docs.splunk.com/Documentation/UpgradejQuery/1/UpgradejQuery/jQueryOverview "If you encounter an issue with jQuery in a Simple XML dashboard that you own, update your custom JavaScript to work with jQuery 3.5, and certify that the dashboard works with jQuery 3.5 by adding version="1.1" to the root node of the dashboard source code. "   ... View more

Hello @leejones4 , You could use the sourcetype definition instead of the sources on the props.conf file For example: props.conf file [meraki] <YOUR_DEFINITIONS_HERE> ... View more

Hello @cbiraris , Which version of Splunk are you using? Are you using Dashboard Studio or Classic Dashboard? Could you please share examples of modifications that are not showing on different browsers (is this only splunk configurations or some custom code using javascript, for example)?   Thanks. ... View more

As @richgalloway said, you probably will want the Victoria Experience. For more details about the differences you could reference for the following: link: https://docs.splunk.com/Documentation/SplunkCloud/latest/Admin/Experience   ... View more

Hello @SplunkAdmin69 , Sorry, I am not familiar with this tutorial, is this a public Splunk tutorial? If yes, could you please post the link of this tutorial? In the first case, if the data is not being shown now you would need to verify: 1) if the role of the user that is searching the data have permissions to search this index. 2) The retention size/time of the index (if the retention is exceeded, this data will be deleted). For the second case, could you please share the complete query? Thanks. ... View more

Hello @thos13 , It is recommended to follow the official Splunk ITSI docs, you can refer to the following: - https://docs.splunk.com/Documentation/ITSI   Also, it is recommended to verify the blueprint of the ITSI exam, with all the relevant informations: - https://www.splunk.com/pdfs/training/Splunk-Test-Blueprint-ITSI-Admin-v1.1.pdf     ... View more