Hi @sanjubaba , in general to use the trend arrow in a Single Value Panel, you need to have from your search two results, the first to use as the current value and the second as the previous one. To better understand how to do this, I hint to install the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603/). in which you can find an example of this. You can do this using a timechart command or a stats command. If you could share your search I could be more detailed. Ciao. Giuseppe ... View more

As Giuseppe wrote, the question (written this way) can mean a lot of things. What I understand from your question is that you want a tool to connect both systems so you can transfer data from them or in between them, right? If you are particularly looking for an external solution, marketplaces are brimming. You just have to know the features you are looking for in the 3rd party tool and test to find out which one works best for your use case. You can connect Splunk with a lot of systems like Cherwell, Ivanti, Dynatrace, BMC, OpsBridge, ServiceNow, and more. Tools like Streamweaver offer connectors for Splunk. What we use is a different tool that is easier to deploy and has a long list of useful Splunk integrations. The team finds it more suitable for work. ... View more

What are your goals for optimisation? How will success be measured? Who will be measuring? All these (and more) can have a bearing on how you approach optimisation. ... View more

Hi @sanjubaba, as @richgalloway said, Splunk 8.x has both Python 2.7 and Python 3.7. It's also avalilable an app to check your apps before migration to Splunk Readiness App (https://splunkbase.splunk.com/app/4698/) and in Splunk 8.2 there's an app called  Python Readiness App ( https://splunkbase.splunk.com/app/5483/) that guides you to the migration. Anyway in Splunk 8.x you can use both the versions, but version 2.x is deprecated so soon will be in phase-out. if you install Spunk 8 without any option, Splunk continue to use Python 2.7, but you can force python 3.7 adding a parameter in server.conf python.version=python3 You can find morte infos at https://docs.splunk.com/Documentation/Splunk/8.2.0/Installation/PlanPython3  Ciao. Giuseppe ... View more

As @richgalloway pointed you to use Splunk platform readiness app to check all your apps/inputs etc. to ensure that those are working with python3. It tells to you if there is something to fix and what this is or are those already compatible. My preferred way it to install first a test environment (e.g. with trial license) with same apps etc. and then check those with it. Then fix what is needed, run again and deploy those fixes to production. Then run (at least) once again that check within production environment. Then follow that installation guide to do the actual upgrade. r. Ismo ... View more

Hi, The upgrade hardly takes 20-30 mins. So estimate the time based on your Splunk instances in your environment. Try to update all of your single instances first. License Master Heavy forwarder Deployment server Then go for the Deployer and search heads. At last upgrade the cluster master and Indexers one by one. If this answer helps you please upvote it. ... View more

Splunk does some parsing for you.  If that's not good enough then please edit your posting to explain your use case.  What data you want to parse, what you want out of it, why, etc.. ... View more

hi @sanjubaba, Check this: https://docs.splunk.com/Documentation/Splunk/8.1.2/Indexer/Setaretirementandarchivingpolicy   ... View more

Hi @sanjubaba, I think that you're speaking of using a Powershell script for data input. Anyway, you can use a scripted input (for more infos see at https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro ). In addition, you could see the Splunk_TA_Windows that uses many PS scripts (https://splunkbase.splunk.com/app/742/). In few words, you can use the PS script in two ways: writing a file: create a script that writes results in a file, put it in the bin folder of your app, schedule it in Windows scheduler, read the file with a monitor input; Directly sending output to Splunk: create a script that send output to video, put it in the bin folder of your app, schedule it in inputs.conf, Universal Forwarder, executes it following the setted configuration and output is directly sent to Splunk. Second choice is better because you can manage it all in Splunk. Ciao. Giuseppe ... View more

Hi @sanjubaba, It is possible to gather logs from your local box with applicable apps that you will load into the Splunk Enterprise instance you are referencing. For a linux machine, load this into the splunk instance: https://splunkbase.splunk.com/app/833/ For a windows machine, load this into the splunk instance: https://splunkbase.splunk.com/app/742/ If you are looking for a specific file itself that isn't covered by these apps or any others: Getting Data In Let us know if this helps out with what you are looking for! V/R, nwuest   ... View more

@inventsekar Thanks. That's a great help. Appreciated!! ... View more

If it's installed with package manager then it's always installed as root. Just enter dpkg -S /opt/splunk/bin/splunk and it tell if that file is installed by package manager. If it's installed from tar then only way to know that is, if those files have owned by root. Of course ownership of files can be changed later or. Which means that you cannot know that (unless you have audit log) later or. It you are meaning in which user is running splunk then @renjith_nair's answers shows it. r. Ismo ... View more

There are several posts already in community. Try to search those with google. Basically when you have single instance just tar old version over your just installed and hope that there haven’t been any changes on index internal formats. If you afraid it before update then take also e.g. snapshot on fs/limit level before update and you could just revert back to it. r. Ismo ... View more

https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/InstallonLinux dpkg —status splunk shows if it has installed with package manager and which version it was. ... View more

Ideally, there should be no data loss while upgrading indexers. However, do consider taking backups before upgrading the indexers as a best practice. So if there are any sudden failures, your data still can be restored from the backup.   Please refer to https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Backupindexeddata for more information.  ... View more

You could found couple of cases how this can do on single instance by just googling with “splunk rollback update” those expects that there haven’t been any changes to indexes e.g. change of compression method etc. r. Ismo ... View more

@thambisetty How to rollback changes if we face any issue during Splunk version upgradation? Can you share me the documentation for it?   ... View more