@emallinger Do you remember which specific parameters were missing? Running into the same problem while using IBM COS as S3 SmartStore. ... View more

I guess Splunk 9.x defauls to systemd again. Any way to revert to init.d? ... View more

Hi, yes, that's exactly what I did and that fixed the issue in my case :). Thanks ! Ema ... View more

Hi again,   You can backup one collection at a time. And yes, you have to "unshedule" all the report that fill your kvstore collections. That can be a bit long and painful. I only had 2 collections so it was not a strech in my case. I had to migrate the kvstore from one SH to another, and I used a backup file. Never tried to sync 2 instances sorry.   I would suggest you try to backup the kvstore in the state you are and then try to restore it on a test SH. If this works => clean both your kvstore SHs and restore there. If not, I'm afraid I would do it all over again : clean it all and then painfully fill again your collections with data. If you still possessed the pertaining data, you can calculate again the collection, at a fast pace for past periods even if it is long. There will definititely be a small service interruption for these collections, but in the end you'll win.   And for later, when you have succeeded to get you kvstore back up and running, I would suggest you add a backup task planned (each day for example).   On another matter : why is your kvstore failing to start ? There should be some insight in `/opt/splunk/var/log/splunk/mongod.log`. Maybe it's just a renew of the certificate for mongo that is needed (probably too easy that one, but who knows...)   Regards, Ema ... View more

HEllo, Same here on splunk version 9.1.0.2. Plus, displays : Plus, I've errors on debug console : Some js files seems to be blocked because of the X-Content-Type Options that are still installation defaults.   Does anyone have any info on this topic ?   Thanks ! Ema ... View more

Hi, Did you find what was wrong ? I have a similar behaviour : curl with ssl to send HEC events works fine, but from a python app, not so well :   Socket error while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number   Any idea ? Thanks Ema ... View more

Hi Ema, thank you very much, I really appreciate your help. I will try this and let you know.  ... View more

Hello all ! I agree with @gcusello.  Depending on the behaviour you wish to create, maybe you'll have to create the alerts and only send the results (via mail ?) to users. Or share only the result in a particular app, developped for that purpose on which users only have read access. In that case, you are doing the job of creating and managing alerts, so it might not be the desired effect. Happy splunking ! Ema ... View more

You can change the thresholds on each enterprise instance. Most of what is described here is locally configured on each instance. See Answers https://community.splunk.com/t5/Splunk-Enterprise/Where-do-I-configure-the-health-conf-so-that-I-can-disable-the/m-p/596827     ... View more

Hello, I wonder if there is an answer to that question ? I'm stuck on it as well. Thanks, Ema ... View more

Hello,   Yes, but source and indexer are in the same time zone, at the same hour. So why the difference ? Thanks for your suggestions, Ema ... View more

Yeah, that I did already : and the access-key transmitted in the bundle are still clear and not encrypted on the Cluster Master AND on all the indexers. It's not very satisfactory to keep it that way. Hence me asking for suggestions. Ema ... View more

Hi, Thanks !! There was an error in file owner ! Goog suggestion ! I'm waiting for the result of that change. If lucky, I'll check your post as a solution. If not, I'll tell. Regards, Ema ... View more

Hello ! Thanks you so much ! I was  starting to feel totally out of the loop on this and was wondering if I didn't miss some huge part of understanding. At least now, I know there's corroboration. Best regards, Ema ... View more

Hello, Thanks , that was exactly what I was looking for ! It pertains to what I understood but wasn't sure enough of. Regards, Ema ... View more

Hello, Thanks, I'm currently doing this one. But, I'd hoped for another solution as I keep storing "faulty" data even though it's useless. (Plus, this is not easy doing that on prod env). Regards, ... View more

Hi, no luck.. same results in the UI (tried with "" and not) :   Thanks for the suggestion anyway. Regards, Ema ... View more