Hi all, We are upgrading one of our environments from Splunk 8.2.0 to Splunk 9.0. We have an issue once we tried to upgrade the indexers, where the Splunk upgrade process got stuck at this point: I was looking onn the internet, but I cannot see anything related to this issue. Can someone help me with this? Many thanks in advance. Best regards. ... View more

Hi all, I need to get a list of all the saved searches that are created in a Splunk Cloud environment. I tried to execute the regular rest command from the search view but the following message appears: I have been checking the capabilities available at the platform but the dispatch to indexers one doesn´t appear in the list (as it does in the on prem version). Do you know which is the proper way on getting this info in Splunk Cloud? Many thanks in advance. Best regards. ... View more

Hi all, From one client is required that users, with a role similar to power, have to be able to upload files using the GUI. With the following capabilities: accelerate_search change_own_password delete_messages edit_monitor edit_search_schedule_window edit_sourcetypes edit_statsd_transforms edit_tcp embed_report export_results_is_visible get_metadata get_typeahead indexes_edit input_file list_accelerate_search list_inputs list_metrics_catalog list_tokens_own metric_alerts output_file pattern_detect request_remote_tok rest_apps_view rest_properties_get rest_properties_set rtsearch run_collect run_mcollect schedule_rtsearch schedule_search search search_process_config_refresh upload_lookup_files Users are able only to reach this point:   I tried to find in the docs what is the missing capability in here, but I cannot find it. Can someone give a hand on this? Many thanks in advance.  Best regards. ... View more

Hi all,   We are in the process of upgrade splunk version from 7.3.3 to 8.0.6. After running the Readiness app and solving all the blocker/warning items, we have proceed to run the upgrade. We are able to start the splunkd service, but the web stucks in waiting for web server forever. Checking web_service.log, we find this error trace: 2021-01-07 14:30:20,566 ERROR   [5ff70cec707fc132868e50] root:772 - Unable to start splunkweb 2021-01-07 14:30:20,566 ERROR   [5ff70cec707fc132868e50] root:773 - 'dict' object has no attribute 'iteritems' Traceback (most recent call last):   File "/opt/splunk/searchhead/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py", line 132, in <module>     from splunk.appserver.mrsparkle.controllers.top import TopController   File "/opt/splunk/searchhead/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/top.py", line 27, in <module>     from splunk.appserver.mrsparkle.controllers.admin import AdminController   File "/opt/splunk/searchhead/lib/python3.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 17, in <module>     import formencode   File "/opt/splunk/searchhead/lib/python3.7/site-packages/formencode/__init__.py", line 9, in <module>     from formencode import validators   File "/opt/splunk/searchhead/lib/python3.7/site-packages/formencode/validators.py", line 15, in <module>     import dns.resolver   File "/opt/splunk/searchhead/etc/apps/generateblocklist_app/bin/dns/resolver.py", line 32, in <module>     import dns.flags   File "/opt/splunk/searchhead/etc/apps/generateblocklist_app/bin/dns/flags.py", line 51, in <module>     _by_value = dict([(y, x) for x, y in _by_text.iteritems()]) AttributeError: 'dict' object has no attribute 'iteritems' Does anyone know how to solve this issue? Thanks in advance.   Best regards. ... View more

Hi all, I´m trying to delete the description that came at the end of some windows events. From the CM I deployed the following configuration in the props.conf: [host::my.windows.host] SEDCMD-strip_detail_msg = s/(?ims)\s+^This\sevent\sis\generated\s.+//g After looking into the events I can see that no SEDCMD has been applied. I´m receiving these events from a UF that collects the logs via WMI with the Splunk_TA_windows. This TA is also installed on the indexers. Thanks in advance. Best regards. ... View more

Hi all, I'm trying to split Windows events into different indexes at index time depending on the host which is sending them. Below there are my props.conf and transforms.conf props.conf: [WMI:WinEventLog:Security] TRANSFORMS-set_new_index = set_index_new transforms.conf [set_index_new] REGEX = MY.HOSTNAME.12.COM FORMAT = windows-new DEST_KEY = _MetaData:Index I tried with different combinations on the regex but none of them worked. Can someone tell me what could be wrong? Thanks in advance. Best. ... View more