Hi, I have the "Upgrade Readiness App" version 4.1.2 installed on my prod and non-prod splunks. https://splunkbase.splunk.com/app/5483 I had a problem with it so uninstalled it and was going to reinstall it but I see the latest version on splunkbase is now 4.1.1. What happened to 4.1.2 - was it withdrawn?  Is that documented anywhere? Thanks, Keith   ... View more

Hi All, I am doing a very simple search over All Time of:        index=index=orafin sourcetype=ORAFIN2       It returns 26 rows and, as this shows, all have a transaction_type value: If I then select D it adds that to the search but retuns NO rows:   Oddly if I change the search to a double negative  I get my data: Whats going on? Hoping to be enlightened, Keith ... View more

Hi All, We just upgraded our HWF to version 8.2.5 and now when we start splunk we get this this message: "ERROR: Detected httpout stanza in outputs.conf , forwarding data over HTTP is only supported on Universal Forwarders. For more information, see " This HWF is outputting all data to the HEC on another splunk instance and is working fine. What is the meaning of the message?  Is this function going to be deprecated?  Note the page it refers to says things like "Supported on Splunk universal forwarders only." It would be a real concern if this is to be deprecated - does anyone have any idea? Thanks, Keith ... View more

Hi. I am trying to run this in splunk cloud: |rest /services/search/jobs|search isRealTimeSearch=1 But getting this: Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability I have looked at users and roles and that capability is not in the list to choose.  It is in theSplunk Cloud documentation but simply isnt there to select. Any ideas why? Thanks, Keith ... View more

Hi, I recently completed the Splunk Cloud Admin course and it made mention that a Hybrid Search Head could be set up on-prem to read data across on-prem and cloud. I have also read about this here and all seems fine:           Splunk Cloud Platform Service Details   But now I have just listened to this video “Apps for Splunk Cloud - Premium Apps” here                 https://splunkpartnerlearningcenter.mindtickle.com/#/course/1346827044233204509?series=1305980034355667330 Then go into the course and play the THIRD video and listen to time from 3:10 to 3:25 it says that the use of a Hybrid search is only for up to 90 days.  Perhaps that video is out of date or perhaps I am misunderstanding. Does anyone know about this 90 day limit as we have several customers moving to the cloud and several want Hybrid search as an option. Thanks ... View more