Hi, We install Splunk_TA_nix and enabled both cpu.sh and cpu_metrics.sh to capture cpu related logs. Do we have SPL query we can use to calculate the CPU Utilization. I do not have indepth Linux background so I am not sure which fields should be use to calculate the percentage of  CPU Utilization. If you can share the formula or fields I need to use from Splunk_TA_nix , I would appreciate it. Our aim is to check the historical  CPU Utilization of our Splunk Heavy Forwarder. Thanks ... View more

Hi Team, We are considering to adopt splunk-connect-for-syslog app (SC4S). Can it be install on Splunk UF or only on Splunk Heavy Forwarder? ... View more

Hi Team, We installed these apps on our License Master as part of IT Essentials Work app SA-ITSI-Licensechecker SA-UserAccess https://docs.splunk.com/Documentation/ITEWork/4.10.2/Install/Install#Install_IT_Essentials_Work_in_a_distributed_environment Then we saw this License "IT Service Intelligence Internals *DO NOT COPY*" appeared Can this license be used for production data ingestion? Can you confirm that this license is included on the IT Essentials Work app itself?   ... View more

Hi All, We are planning to configure some of our universal forwarders to use multiple pipeline sets. Do you have some sort of SPL that we can use to identify which forwarders have blocking queues and needs to increase the number of pipeline set. ... View more

Hi @ehaddad_splunk , In our environment, we currently have Splunk App for Salesforce v3.0.0  Splunk Add-on for Salesforce v2.0.0 Now, we are planning to upgrade the Splunk Add-on for Salesforce to v4.0.2 which supports both Splunk Enterprise v7.2.9.1 and v8.1.x because we will upgrade Splunk Enterprise to v8.1.1 in the near future. With this, if we upgrade Splunk Add-on for Salesforce to v4.0.2, would it still be working with Splunk App for Salesforce v3.0.0? We check Splunk App for Salesforce v3.0.0 and it only supports Splunk Enterprise v7.2.x so we would like to confirm with you as author of Splunk App for Salesforce, if Splunk App for Salesforce v3.0.0 is still compatible with Splunk Add-on for Salesforce v4.0.2 as well as Splunk Enterprise v8.1.1?. Looking forward to your feedback. ... View more

Hi Team, We have Splunk Enterprise v7.2.9.1 and planning to upgrade to v8.1.1. Now, as a pre-requisite,  we will upgrade the  Splunk_TA_nix  v7.0.1 to  Splunk_TA_nix  v8.2.0 so that it will be compatible to both Splunk Enterprise v7.2.9.1 and v8.1.1. In our environment, we still have Splunk Universal Forwarders who are in v7.0.4. With this, our question is, if we upgrade the Splunk_TA_nix  to v8.2.0, would it still work to Splunk Universal Forwarders v7.0.4?  In Splunkbase, Splunk_TA_nix v8.2.0 is only compatible to Splunk Version v7.2 or later. https://splunkbase.splunk.com/app/833/   Will Splunk_TA_nix v8.2.0 work with Splunk UF v7.0.4? Let me know your insights. Thanks ... View more

Hi Team, We asked our Linux Team and they said that the hyperthreading is enabled across all Clustered Indexers. This Indexers are all Physical servers. Our issue is that we have High CPU Usage on our Indexers so we wanted to check if Splunk is utilizing the benefit of hyperthreading and how we can verify and check it. Do we have additional step to configure on Splunk side to use the hyperthreading of the Linux server?   Any ideas or SPL queries you can share that would be helpful. Thanks    ... View more

Hi @aplura_llc_supp/@mikerefakis,   We are using the NetSkope App v1.2.0 in our Splunk instance (v7.2.9.1) to collect the data from Netskope. We are encountering an issue where we are trying to fetch the data through the app, but fails to do so even after changing the token in NetSkope app in Splunk. It is worth noting that the token from NetSkope was changed. So we updated the token on NetSkope app in Splunk but the issue still persists even after token update. Below are the errors received in Splunk:   log_level=ERROR pid=108789 tid=MainThread file="netskope_client.py" function="next_page" line_number="134" version="NetSkopeAppForSplunk.v1.2.0.b252" exception='data' message='data' exception_type=KeyError exception_arguments='data' filename=netskope_client.py exception_line=82   log_level=ERROR pid=65944 tid=MainThread file="Utilities.py" function="get_credential" line_number="340" version="NetSkopeAppForSplunk.v1.2.0.b252" message="Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/NetSkopeAppForSplunk/storage/passwords: [Errno 104] Connection reset by peer',)" exception_type="SplunkdConnectionException" exception_arguments="Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/NetSkopeAppForSplunk/storage/passwords: [Errno 104] Connection reset by peer',)" filename="Utilities.py" line="311"   Regards, Kevin ... View more

Hi Team, We are experiencing frequent high CPU usage on Indexers and it seems like the huge factor of it are from searches with "All time" Time filter and real time searches. With this, do we have some steps on how to restrict user on using "All time" Time filter and real time searches? Is it related to Splunk roles? and if yes, what capabilities should be remove from them so that they will not be able to use "All time" Time filter and real time searches. ... View more

Hi Splunkers, We recently migrated to Splunk Search Head Clustering.  We are using a Load Balancer in front of 3 Search Heads Clustered so that the users can access the set of search heads through a single interface, without needing to specify a particular one. Now, we notice that the email alerts we received are coming randomly from any of the 3 Search Heads Clustered. It means the email alert sender for Splunk SHC comes from any 3 Search Heads Clustered. Is there a way to make it appear the alert is being sent by the load balancer name? So that once the users receives the alerts, the email alert sender is uniform. ... View more

Hi Splunk Folks, We have Splunk Physical Servers with 8GB disk space storage for /opt folder which frequently reaching 90% of the disk space threshold (7.2GB). Since we cannot easily upgrade the disk space because these are Physical servers, we are looking for files that we can remove or migrate. We found this "/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/save" folder (1GB in size) that seems like containing the same files (btree_index.dat, btree_records.dat and snapshot) with its predecessor folder (/opt/splunk/var/lib/splunk/fishbucket/splunk_private_db) Are questions are, what are these Splunk files do and does it safe if we will delete or move them to another folder to free some disk space on /opt? Here is the commands we used to check which file has consume a large volume of diskspace -bash-4.2$ df -h /opt/splunk Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg00-opt 8.0G 6.5G 1.6G 82% /opt -bash-4.2$ du -h --max-depth=1 /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db 1001M /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/save (Has the most consumed diskspace) 335M /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/snapshot 1.7G /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/ (Total) If we look inside the "save" folder from /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db, we can see it has same files (btree_index.dat, btree_records.dat and snapshot) . Thus it just might be a backup of splunk_private_db -bash-4.2$ ls -l /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db -rw-------. 1 splunk splunk 104865400 Jun 24 04:52 btree_index.dat -rw-------. 1 splunk splunk 246211800 Jun 24 04:56 btree_records.dat drwx------. 3 splunk splunk 79 Jun 24 04:49 save drwx------. 2 splunk splunk 70 Jun 24 04:49 snapshot -bash-4.2$ ls -l /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db/save -rw-------. 1 splunk splunk 152715440 Nov 22 2019 btree_index.dat -rw-------. 1 splunk splunk 371572840 Nov 22 2019 btree_records.dat drwx------. 2 splunk splunk 70 Nov 22 2019 snapshot   Regards, John Kevin Aracan ... View more

Hi Splunkers, One of our Splunk Clustered Indexer (Physical Server) will go thru to a battery replacement that might take around 1-2 hours. With this, we would like to seek your advice since this one Splunk Clustered Indexer (Physical Server) will be down for around 1-2 hours during the battery replacement. During the Splunk Clustered Indexer (Physical Server) battery replacement, do we need to initiate maintenance-mode or run splunk offline command? We would like to hear your feedback to avoid bucket related issues. Regards, Kevin ... View more

Hi Team, Just wanted to check with you what is the difference between host and NetworkDeviceName in Cisco ISE context? I had use the SPL queries below and have different results. index=cisco_ise | stats count by host index=cisco_ise | stats count by NetworkDeviceName A little background on Architecture, we have Syslog servers (Splunk Forwarders as well) where cisco ise traffic logs are written, then we use Splunk file monitoring to check those cisco ise traffic logs and ingest it to Splunk. We also have Splunk Add-on for Cisco ISE installed on those Syslog servers/Splunk Forwarders. Then we have that Splunk Add-on for Cisco ISE also on our Indexer Tier and Search Tier for field extraction and other conf. On our Search Head, we have the SplunkApp for Cisco ISE. Regards, Jaracan ... View more