Hi, Not sure if this is even a problem, but thought I would be proactive and ask what other folks have experienced.  *Note* that I am note an experienced splunk admin - I can do a few things, add users, add forwarders, and have updated to newer version, but I really don't know how to use it. Admin newby. We are running splunk enterprise v 8.2.6, on a single RHEL6 server. We need to get off of RHEL6, so plan was to migrate the splunk install to a new RHEL8 server, and then upgrade to newest splunk version. My understanding of splunk is that it is pretty self contained - to update the version, you just overwrite the /opt/splunk dir with the new splunk tar file. Our data is held in a separate filesystem, /data/splunk dir. So, the process was: 1- install splunk v 8.2.6 on the new rhel8 server, and verify it starts and works 2- shutdown old rhel6 splunk 3- copy the old rhel6 /opt/splunk dir on top of the new rhel8 /opt/splunk dir 4- copy the old rhel6 /data/splunk dir on to the new rhel8 server, in the /data/splunk dir 5- shutdown the rhel6 splunk server 6- ensure all the networking, DNS, etc is resolving to the new rhel8 server 7- start up splunk on the new rhel8 server The process was followed by me this morning, and appears to have worked. I am seeing forwarders (there are 160) check in on the new server, I can run searches on host=X and see that X has been in contact. But there is one thing I am seeing, that I don't know if it is a problem or not. If I look at "Indexes and Volumes: Instance" for the previous 24 hours, there is data there up until the old rhel6 server was turned off. Since moving to the new rhel8 server, the indexes all appear to be 0GB in size. I don't know enough to know whether this is an issue. It seems like it is, to me, but I am not really sure - could everything just be rebuilding on the new server, or has it become unavailable somehow? If anyone has an answer I would be glad to know. Otherwise I find out Monday morning, I guess, when the users log on to the new rhel8 server. Thanks, Michael. ... View more

Environment - single splunk enterprise instance (v. 8.2.6) running on a RHEL 6.1 server, receiving data from  multiple forwarders. Issue - License volume has always shown as 30GB/day, for the past few years anyway. Found out today that the last license purchased (January 2022) was for 50GB/Day, but the license page is still showing 30G/day. How do I get the correct volume showing for our licensing? I would have thought it would have been automatic, or part of the license install process. ... View more

When adding logs from forwarders [Add Data - Select Forwarders], the list of available hosts appears to be random. We have hundreds of servers, having to scroll though pages of servers names that all look the same to find the one you want is a royal pain.  Is there any way to have that list appear sorted to make the selection process easier? Thanks. ... View more