Examine the bundle file.  tar -tf <bundle-file-name> ... View more

ITSI default backups do rotate,  - in older versions the last one was overwritten - since 4.3 and later, the last 7 are kept. and the file name changed too include the date. see https://docs.splunk.com/Documentation/ITSI/4.3.0/ReleaseNotes/Newfeatures The backups you have seems to be in the new format. I do not know why the older ones are gone, is it a bug, did you clean up the folder during the reinstall ? if you wiped the kvstore, it's possible that the record of the backups was lost, and the old files cleaned up ? ... View more

In alerts for splunk admins https://splunkbase.splunk.com/app/3796/ I have an alert to detect a lack of logging from mongod.log so combined with richgalloway's answer this might work for you... ... View more

Hi @Master_Blaster , Can you check for the following SPL query: | tstats values(source) as sources ,values(sourcetype) as sourcetype where index=* by host | lookup dnslookup clienthost as host OUTPUT clientip as src_ip Output of this command would show servers (as per your requirement), with both sourcetype and source information.   If this helps, mark it as answer. Happy Splunking! 🙂 ... View more