We are planning to migrate to a Two-Tiered Splunk Deployment Server Architecture. Do we have guidelines that we can check so we can plan accordingly. And also, with regard to app deployment in a Two-Tiered Splunk Deployment Server Architecture, do we need to do the command splunk reload deploy-server twice (one in Master DS and another one in Slave DS) whenever we have some updates in the apps(deployment-apps)? Looking forward to your insights. Thank you ... View more

Hi Team, Good day! Just wanted to check if you can share with me the link for Older version of Splunk Enterprise/UF installers: Splunk Enterprise version v6.6.2 (Linux 32 and 64 bit) Splunk Enterprise version v7.1.10  (Linux 32 and 64 bit) Splunk Enterprise version v8.0.10  (Linux 32 and 64 bit)   Splunk UF version v6.6.2 (Linux 32 and 64 bit) Splunk UF version v7.1.10  (Linux 32 and 64 bit) Splunk UF version v8.0.10  (Linux 32 and 64 bit) Also, the final target version is Splunk Enterprise version is 8.2.7. Can you confirm if which order below would work? Option 1: Splunk v6.6.2 ->upgrade to Splunk v7.1.10  -->upgrade to Splunk v8.0.10 -->upgrade to v8.2.7 Option 2: Splunk v6.6.2 ->upgrade to Splunk v7.1.10  -->upgrade to v8.2.7 (Can we upgrade direct from v7.1.10 to v8.2.7?) We are planning to upgrade some very old Splunk instances and we wanted to simulate first on our test environment. We are looking forward to your assistance on this. Thank you.   ... View more

Hi, We install Splunk_TA_nix and enabled both cpu.sh and cpu_metrics.sh to capture cpu related logs. Do we have SPL query we can use to calculate the CPU Utilization. I do not have indepth Linux background so I am not sure which fields should be use to calculate the percentage of  CPU Utilization. If you can share the formula or fields I need to use from Splunk_TA_nix , I would appreciate it. Our aim is to check the historical  CPU Utilization of our Splunk Heavy Forwarder. Thanks ... View more

Hi Team, We are considering to adopt splunk-connect-for-syslog app (SC4S). Can it be install on Splunk UF or only on Splunk Heavy Forwarder? ... View more

Hi Team, We installed these apps on our License Master as part of IT Essentials Work app SA-ITSI-Licensechecker SA-UserAccess https://docs.splunk.com/Documentation/ITEWork/4.10.2/Install/Install#Install_IT_Essentials_Work_in_a_distributed_environment Then we saw this License "IT Service Intelligence Internals *DO NOT COPY*" appeared Can this license be used for production data ingestion? Can you confirm that this license is included on the IT Essentials Work app itself?   ... View more

Hi All, We are planning to configure some of our universal forwarders to use multiple pipeline sets. Do you have some sort of SPL that we can use to identify which forwarders have blocking queues and needs to increase the number of pipeline set. ... View more

Hi @ehaddad_splunk , In our environment, we currently have Splunk App for Salesforce v3.0.0  Splunk Add-on for Salesforce v2.0.0 Now, we are planning to upgrade the Splunk Add-on for Salesforce to v4.0.2 which supports both Splunk Enterprise v7.2.9.1 and v8.1.x because we will upgrade Splunk Enterprise to v8.1.1 in the near future. With this, if we upgrade Splunk Add-on for Salesforce to v4.0.2, would it still be working with Splunk App for Salesforce v3.0.0? We check Splunk App for Salesforce v3.0.0 and it only supports Splunk Enterprise v7.2.x so we would like to confirm with you as author of Splunk App for Salesforce, if Splunk App for Salesforce v3.0.0 is still compatible with Splunk Add-on for Salesforce v4.0.2 as well as Splunk Enterprise v8.1.1?. Looking forward to your feedback. ... View more

Hi Team, We have Splunk Enterprise v7.2.9.1 and planning to upgrade to v8.1.1. Now, as a pre-requisite,  we will upgrade the  Splunk_TA_nix  v7.0.1 to  Splunk_TA_nix  v8.2.0 so that it will be compatible to both Splunk Enterprise v7.2.9.1 and v8.1.1. In our environment, we still have Splunk Universal Forwarders who are in v7.0.4. With this, our question is, if we upgrade the Splunk_TA_nix  to v8.2.0, would it still work to Splunk Universal Forwarders v7.0.4?  In Splunkbase, Splunk_TA_nix v8.2.0 is only compatible to Splunk Version v7.2 or later. https://splunkbase.splunk.com/app/833/   Will Splunk_TA_nix v8.2.0 work with Splunk UF v7.0.4? Let me know your insights. Thanks ... View more

Hi Team, We asked our Linux Team and they said that the hyperthreading is enabled across all Clustered Indexers. This Indexers are all Physical servers. Our issue is that we have High CPU Usage on our Indexers so we wanted to check if Splunk is utilizing the benefit of hyperthreading and how we can verify and check it. Do we have additional step to configure on Splunk side to use the hyperthreading of the Linux server?   Any ideas or SPL queries you can share that would be helpful. Thanks    ... View more

Hi @aplura_llc_supp/@mikerefakis,   We are using the NetSkope App v1.2.0 in our Splunk instance (v7.2.9.1) to collect the data from Netskope. We are encountering an issue where we are trying to fetch the data through the app, but fails to do so even after changing the token in NetSkope app in Splunk. It is worth noting that the token from NetSkope was changed. So we updated the token on NetSkope app in Splunk but the issue still persists even after token update. Below are the errors received in Splunk:   log_level=ERROR pid=108789 tid=MainThread file="netskope_client.py" function="next_page" line_number="134" version="NetSkopeAppForSplunk.v1.2.0.b252" exception='data' message='data' exception_type=KeyError exception_arguments='data' filename=netskope_client.py exception_line=82   log_level=ERROR pid=65944 tid=MainThread file="Utilities.py" function="get_credential" line_number="340" version="NetSkopeAppForSplunk.v1.2.0.b252" message="Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/NetSkopeAppForSplunk/storage/passwords: [Errno 104] Connection reset by peer',)" exception_type="SplunkdConnectionException" exception_arguments="Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/NetSkopeAppForSplunk/storage/passwords: [Errno 104] Connection reset by peer',)" filename="Utilities.py" line="311"   Regards, Kevin ... View more