In Splunk Enterprise 9.0.0.1, I scheduled a saved search with an invalid macro name in it. When run, I receive the following error message as I should: Error in 'SearchParser': The search specifies a macro 'my_macro' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information. The search was skipped, the error was logged to scheduler.log, and the log ingested into _internal all as expected. However, the reason field gets cut off because of the quotation marks in the error message. It thinks the field value ends at "have" when it should end at "information." I believe this is a minor defect. Is there any way to submit a bug report? I tried creating a case but received a message saying I don't have  a Support Contract or entitlement to do so. Can anyone point me in the right direction? Thanks!   Edit: Created Splunk Ideas post: https://ideas.splunk.com/ideas/EID-I-1586 ... View more

I passed the new exam in January 2019. My understanding was under the new system the Admin certification expired 2 years from the date of passing the exam. Now that I am coming up on the 2 year mark, however, I see in the FAQ's Recertification section that "all certifications are now subject to a 3-year life cycle." I can't seem to find where my certification expiration date would be (though I see it is still active for now in the Splunk Partner+ My Accreditations & Certifications page) and have a few questions: Does my Splunk Enterprise Certified Admin certification that I thought lasted 2 years now last 3? Or does it still only last 2 since when I earned it it only lasted 2? Where can I view my certification's expiration date? Do I have to retake the Admin courses to recertify or can I just go straight to the exam? Thanks in advance ... View more