in datadog you can use log forwarding to send any logs into splunk using splunk HEC token ... View more

Please tell us about the problem you are trying to solve.  What log changes do you want to track?  Splunk already automatically indexes new log entries, but are there other changes you want to know about? ... View more

Hi @poojas89  Did you follow the installation instructions on the Splunkbase app page at https://splunkbase.splunk.com/app/8308#Installation:~:text=Details-,Installation,-Troubleshooting ? If you are still struggling you could reach out to the developer using their Support email: [email protected] or raise an issue on the app GitHub repo at https://github.com/rootiq-ai/splunk_genai_observability   🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

We're just members of the Splunk Community and don't have access to your account.  You can try contacting Splunk Support. I removed your email address from the message. ... View more

There are a few ways to onboard data into Splunk. Install a universal forwarder on the server to send log files to Splunk.  This probably won't work in your case. Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog Use the server's API to extract data for indexing Use Splunk DB Connect to pull data from the server's SQL database. Have the application send data directly to Splunk using HTTP Event Collector (HEC). ... View more

Thanks a lot Giusepe, fantastic as usual. ... View more

Was attempting to access these downloads from my company system.  Turns out Cross-Origin Resource Sharing is disabled by company policy.   Will download these from home.  Something to keep in mind when accessing from corporate sites. ... View more

Hey, finally figured it out.  After updating the attribute to REPORT as suggested and updating permission to GLOBAL on transformation, this eliminated the errors, but fields were still not extracting. It appears the quotes I added around the original key field name (as the field in the CSV had a space) were not required.  Once I removed the quotes from the key field name, all works as expected... Thanks for your assistance, learned a lot figuring this one out! ... View more

Splunk Enterprise NOT provide native encryption at rest for indexed data stored locally.  There is no documentation of that just as there is no documentation for the many other features Splunk does not provide. Splunk does not offer a recommended means for at-rest encryption.  That's up to each customer based on their requirements and capabilities. ... View more

My LM and MC are on the same server instance.   The CM is on another server instance.  I opened a Splunk Support ticket, and the connectivity is good using CLI commands. We have escalated to a Splunk Dashboard SME for further troubleshooting.  Thanks @isoutamo , @PickleRick , and @richgalloway  ... View more

You can try to look https://github.com/ryanadler/downloadSplunk There is also historical.list where are listed all versions since 7.0.0.  Basically this should helps you to get also those orders versions. ... View more

We are seeing this ACAS vulnerability on at least one of our Splunk Servers with version 10.2.6 installed Are there plans to fix this for Splunk 10.2.x?    Path : /opt/splunk/opt/mongo/lib/libcurl.so.4.8.0 Installed version : 8.14.1 Fixed version : 8.21.0 Potential Vulnerability : Component ... View more

Ok, thanks! Will do it. ... View more

This is a tricky problem if you don't have access to the Splunk itself (if you do - you can create a list of buckets to back up using @richgalloway 's method). As you can see here - https://help.splunk.com/en/data-management/manage-splunk-enterprise-indexers/9.0/indexing-overview/manage-index-storage/how-the-indexer-stores-indexes#bucket-names-0 the bucket directory name contains its ID. You should _not_ have two distinct buckets with the same ID. So that's one thing -  you can "deduplicate" on bucket ID. To be on the safe side you can use ID and start/end times. But it's not all that easy since if you have SF<RF some bucket copies might be searchable, some not. So you would need to check which copy is the searchable one for copying. You could just copy the biggest one but this way you still might be backing up too much because within the bucket directory you might get addiitonal data - datamodel acceleration summaries, saved search acceleration summaries - there can be a lot going on (if you don't have separate volume defined for those). So _I_ would probably go over each bucket ID from each cluster node for a given index and copy over the biggest bucket directory (and then check if there is no "discardable" data contained within). ... View more

Why is RF considered in cache sizing. I understood from this document that cache should not hold multiple copies of data. Only hot buckets would have RF. Based on that I estimate that to hold 10 TB of data for 30 days of local cache at 50% compression, I would need 5 x 30 =150 150 TB. But you have calculated it as 310 TB. Is my assumption wrong? Please note that I am not considering hot bucket storage in this calculation. ... View more

To get unsupported version of Splunk for interim upgrade steps, contact Splunk Support.  They can get it for you. ... View more

Hi @cdCryptoMetrics  As others have said, you cannot send data out of Splunk Cloud in the same way as enterprise.  You might want to look at something such as the "sendtohec Custom Search Command" app which you could run in the search to send the output to the HEC receiver of the on-premise Splunk instance - there are other apps which work similarly but often rely on other ingestion on the receiving end, at least HEC remains Splunk native. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing. ... View more

Deleting instance.cfg will not help with connectivity issues.  It will force the UF to generate a new GUID for itself and make it appear as a new UF to the DS.  The old GUID will show up as a "missing forwarder" in the Monitoring Console. ... View more

I'm not talking about backward compatibility. EEE strategy is something completely different. It's not about the product itself, it's about influencing the overall ecosystem and "extinguishing" competition. But again - it's not the time or place for this discussion. ... View more

You can get it from here https://splunk.my.site.com/customer/s/article/0-byte-license-for-Deployment-Server-or-Heavy-Forwarder ... View more

One additions. If you are using EntraID then I suppose that you must use windows HF which is joined to it. At least older dbx (3.18.x) with Linux can’t authenticate with EntraID accounts. Instead of you must use sql server’s internal users. ... View more

Hi @kjain041523 , you must use as token the same field name of the Detection search, in yur case $host$ and not $Host$. Ciao. Giuseppe ... View more

For BOTSv3, don't hand-roll it — install the TAs from the dataset's required add-on list plus Splunk_SA_CIM. Those TAs already carry most of the field aliases. Then per sourcetype, CIM compliance is really four things Field aliases - rename source fields to CIM names (user, src, dest, action, etc.) in props.conf. Tags - the part people miss. Models constrain on tags, not sourcetypes. Add an eventtype + tag (tag=authentication, tag=network, etc.) or the model stays empty. Populate recommended fields, not just required ones. Validate with | datamodel Authentication search | search sourcetype=X. Empty result = almost always a missing tag, not a missing alias. ... View more

As @richgalloway already said this is known issue. It could be also false positive as tresholds are too low.  There are several articles and discussions of it already. I link just some here: https://splunk.my.site.com/customer/s/article/Health-Report-IOWait-Showing-Red https://splunk.my.site.com/customer/s/article/iowait https://community.splunk.com/t5/Splunk-Enterprise/Why-is-the-health-status-of-IOWait-red/m-p/599097 https://help.splunk.com/en/splunk-enterprise/administer/monitor/9.0/proactive-splunk-component-monitoring-with-the-splunkd-health-report/configure-the-splunkd-health-report   ... View more