Hi, Our project is planning to have Splunk ITSI to do batch monitoring from Control M jobs and have autohealing as well. Would that be feasible with Splunk ITSI? Does Splunk ITSI have capabilities to take action like running a custom script to force restart, or force OK a Control M job once conditions are met to be ? Looking forward to your insights. ... View more

Hi, Good day! Just wanted to check your insights or any reference that you can share. We have Clustered Multisite Splunk environment and Splunk ES SHC and let's say correlation searches is triggered, it will generate notable events. Is it possible that these notable events will be sent to another platform (example: Google Chronicle). If yes, can you share how it will be done? So let's say, the notable event is generated, it will be stored in Splunk locally and will also be forwarded to Google Chronicle SOAR. Is it possible? ... View more

Hi Splunkers, We have requirement to monitor wineventlogswith sourcename MSSQL and will be sent to different sets of IDX. For global IDX,  the wineventlogs inputs will be sourcename MSSQL only For abc-region, the wineventlogs inputs will be sourcename MSSQL and ComputerName with ending in "abc.com" domain (e.g. XXXXX.abc.com, YYYY.abc.com). With this, is the configurations below correct? Looking forward to your insights.   ########################################## inputs.conf ##################################### [WinEventLog://Application] index=mssql_idx whitelist= SourceName=%MSSQL% sourcetype=mssql:app disabled=false _TCP_ROUTING=idx-all-global crcSalt=<SOURCE> [WinEventLog://Application] index=mssql_idx whitelist= SourceName=%MSSQL% ComputerName=%abc.com% sourcetype=mssql:app disabled=false _TCP_ROUTING=idx-abc-region crcSalt=<SOURCE> ########################################## outputs.conf ########################################## [indexAndForward] index=false [tcpout] defaultGroup= idx-all-global, idx-abc-region [tcpout:idx-all-global] server=global-idx1:9997, global-idx2:9997 [tcpout:idx-abc-region] server= abc-region-idx1:9997, abc-region-idx2:9997   ... View more

Hi, Seems like this link below is no longer working. https://splunk-sizing.appspot.com/   Does Splunk have online splunk sizing that we can use to do capacity planning estimates? ... View more

We are planning to migrate to a Two-Tiered Splunk Deployment Server Architecture. Do we have guidelines that we can check so we can plan accordingly. And also, with regard to app deployment in a Two-Tiered Splunk Deployment Server Architecture, do we need to do the command splunk reload deploy-server twice (one in Master DS and another one in Slave DS) whenever we have some updates in the apps(deployment-apps)? Looking forward to your insights. Thank you ... View more

Hi Team, Good day! Just wanted to check if you can share with me the link for Older version of Splunk Enterprise/UF installers: Splunk Enterprise version v6.6.2 (Linux 32 and 64 bit) Splunk Enterprise version v7.1.10  (Linux 32 and 64 bit) Splunk Enterprise version v8.0.10  (Linux 32 and 64 bit)   Splunk UF version v6.6.2 (Linux 32 and 64 bit) Splunk UF version v7.1.10  (Linux 32 and 64 bit) Splunk UF version v8.0.10  (Linux 32 and 64 bit) Also, the final target version is Splunk Enterprise version is 8.2.7. Can you confirm if which order below would work? Option 1: Splunk v6.6.2 ->upgrade to Splunk v7.1.10  -->upgrade to Splunk v8.0.10 -->upgrade to v8.2.7 Option 2: Splunk v6.6.2 ->upgrade to Splunk v7.1.10  -->upgrade to v8.2.7 (Can we upgrade direct from v7.1.10 to v8.2.7?) We are planning to upgrade some very old Splunk instances and we wanted to simulate first on our test environment. We are looking forward to your assistance on this. Thank you.   ... View more

Hi, We install Splunk_TA_nix and enabled both cpu.sh and cpu_metrics.sh to capture cpu related logs. Do we have SPL query we can use to calculate the CPU Utilization. I do not have indepth Linux background so I am not sure which fields should be use to calculate the percentage of  CPU Utilization. If you can share the formula or fields I need to use from Splunk_TA_nix , I would appreciate it. Our aim is to check the historical  CPU Utilization of our Splunk Heavy Forwarder. Thanks ... View more

Hi Team, We are considering to adopt splunk-connect-for-syslog app (SC4S). Can it be install on Splunk UF or only on Splunk Heavy Forwarder? ... View more

Hi Team, We installed these apps on our License Master as part of IT Essentials Work app SA-ITSI-Licensechecker SA-UserAccess https://docs.splunk.com/Documentation/ITEWork/4.10.2/Install/Install#Install_IT_Essentials_Work_in_a_distributed_environment Then we saw this License "IT Service Intelligence Internals *DO NOT COPY*" appeared Can this license be used for production data ingestion? Can you confirm that this license is included on the IT Essentials Work app itself?   ... View more

Hi All, We are planning to configure some of our universal forwarders to use multiple pipeline sets. Do you have some sort of SPL that we can use to identify which forwarders have blocking queues and needs to increase the number of pipeline set. ... View more

Hi @ehaddad_splunk , In our environment, we currently have Splunk App for Salesforce v3.0.0  Splunk Add-on for Salesforce v2.0.0 Now, we are planning to upgrade the Splunk Add-on for Salesforce to v4.0.2 which supports both Splunk Enterprise v7.2.9.1 and v8.1.x because we will upgrade Splunk Enterprise to v8.1.1 in the near future. With this, if we upgrade Splunk Add-on for Salesforce to v4.0.2, would it still be working with Splunk App for Salesforce v3.0.0? We check Splunk App for Salesforce v3.0.0 and it only supports Splunk Enterprise v7.2.x so we would like to confirm with you as author of Splunk App for Salesforce, if Splunk App for Salesforce v3.0.0 is still compatible with Splunk Add-on for Salesforce v4.0.2 as well as Splunk Enterprise v8.1.1?. Looking forward to your feedback. ... View more

Hi Team, We have Splunk Enterprise v7.2.9.1 and planning to upgrade to v8.1.1. Now, as a pre-requisite,  we will upgrade the  Splunk_TA_nix  v7.0.1 to  Splunk_TA_nix  v8.2.0 so that it will be compatible to both Splunk Enterprise v7.2.9.1 and v8.1.1. In our environment, we still have Splunk Universal Forwarders who are in v7.0.4. With this, our question is, if we upgrade the Splunk_TA_nix  to v8.2.0, would it still work to Splunk Universal Forwarders v7.0.4?  In Splunkbase, Splunk_TA_nix v8.2.0 is only compatible to Splunk Version v7.2 or later. https://splunkbase.splunk.com/app/833/   Will Splunk_TA_nix v8.2.0 work with Splunk UF v7.0.4? Let me know your insights. Thanks ... View more

Hi Team, We asked our Linux Team and they said that the hyperthreading is enabled across all Clustered Indexers. This Indexers are all Physical servers. Our issue is that we have High CPU Usage on our Indexers so we wanted to check if Splunk is utilizing the benefit of hyperthreading and how we can verify and check it. Do we have additional step to configure on Splunk side to use the hyperthreading of the Linux server?   Any ideas or SPL queries you can share that would be helpful. Thanks    ... View more

Hi @aplura_llc_supp/@mikerefakis,   We are using the NetSkope App v1.2.0 in our Splunk instance (v7.2.9.1) to collect the data from Netskope. We are encountering an issue where we are trying to fetch the data through the app, but fails to do so even after changing the token in NetSkope app in Splunk. It is worth noting that the token from NetSkope was changed. So we updated the token on NetSkope app in Splunk but the issue still persists even after token update. Below are the errors received in Splunk:   log_level=ERROR pid=108789 tid=MainThread file="netskope_client.py" function="next_page" line_number="134" version="NetSkopeAppForSplunk.v1.2.0.b252" exception='data' message='data' exception_type=KeyError exception_arguments='data' filename=netskope_client.py exception_line=82   log_level=ERROR pid=65944 tid=MainThread file="Utilities.py" function="get_credential" line_number="340" version="NetSkopeAppForSplunk.v1.2.0.b252" message="Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/NetSkopeAppForSplunk/storage/passwords: [Errno 104] Connection reset by peer',)" exception_type="SplunkdConnectionException" exception_arguments="Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/NetSkopeAppForSplunk/storage/passwords: [Errno 104] Connection reset by peer',)" filename="Utilities.py" line="311"   Regards, Kevin ... View more

Hi Team, We are experiencing frequent high CPU usage on Indexers and it seems like the huge factor of it are from searches with "All time" Time filter and real time searches. With this, do we have some steps on how to restrict user on using "All time" Time filter and real time searches? Is it related to Splunk roles? and if yes, what capabilities should be remove from them so that they will not be able to use "All time" Time filter and real time searches. ... View more

Hi Splunkers, We recently migrated to Splunk Search Head Clustering.  We are using a Load Balancer in front of 3 Search Heads Clustered so that the users can access the set of search heads through a single interface, without needing to specify a particular one. Now, we notice that the email alerts we received are coming randomly from any of the 3 Search Heads Clustered. It means the email alert sender for Splunk SHC comes from any 3 Search Heads Clustered. Is there a way to make it appear the alert is being sent by the load balancer name? So that once the users receives the alerts, the email alert sender is uniform. ... View more