This is for Splunk Enterprise but it essentially applies for Splunk Cloud as well: Immutability of indexed data Once data has been added to an index, you cannot edit or otherwise change the data. You can delete all data from an index or you can delete, and optionally archive, individual index buckets based on policy, but you cannot selectively delete individual events from storage. https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.4/indexing-overview/how-indexing-works#ariaid-title3 ... View more

Anyone looking here for a solution to this issue, please vote on this Splunk Idea (not mine, but want it implemented).  Thanks! "Allow querying of all notes for all findings through REST endpoint instead of only single findings at a time" https://ideas.splunk.com/ideas/SMCID-I-57 ... View more

Hi @performancemoni  I know this answer is a bit late, but maybe it will help others that run into this issue.  The "MS-SQL Server Using MS Generic Driver With Windows Authentication" is only supported when DB Connect is running on a Windows server.  Try Kerberos authentication instead. https://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Installdatabasedrivers#Microsoft_SQL_Server ... View more

@dataisbeautiful  You should be able to control this by adding this line: display.visualizations.charting.chart = line to the following .conf file(s): Global: $SPLUNK_HOME/etc/system/local/ui-prefs.conf Per User: $SPLUNK_HOME/etc/users/<username>/system/local/ui-prefs.conf For more information see: https://docs.splunk.com/Documentation/Splunk/9.3.1/admin/Ui-prefsconf ... View more

We fixed this issue by changing the HEC endpoint that the data was being sent to from services/collector/raw to  services/collector/event. More information here: https://docs.splunk.com/Documentation/Splunk/latest/Data/HECRESTendpoints ... View more

@Dave2d   Did you ever find a resolution for this issue?  Thanks! ... View more

Updated link: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Whathappenswhenamanagernodegoesdown ... View more

I ran into this same issue on Splunk 8.0.10 and Cisco eStreamer eNcore 4.8.3 Add-on.  The solution for me was to move the setup.xml from the bin folder to the default folder. mv /opt/splunk/etc/apps/TA-eStreamer/bin/setup.xml /opt/splunk/etc/apps/TA-eStreamer/default/   ... View more