Hi @uagraw01  I just skim thorugh it can you try appendcols command insteaed of append let us know if that works  ... View more

Hi @danielbb  As mentioned by @richgalloway  config reload will be done automatically if app installed via UI, no need to explictly run the commad for config to take effect. however reload command for pushing apps to UF looks like below /opt/splunk/bin/splunk btool reload deploy-server -class <serverclassname> ... View more

Hi   @Narendra_Rao  for upgrading to KV store 7.x first kV store need to be in 4.2x, by looking at your kv store version its in 4.1.7  this is reason upgrade is failing  you need to upgrade to 4.2x. then go for 7.x  Upgarde document to 4.2.x https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.3/administer-the-app-key-value-store/migrate-the-kv-store-storage-engine then upgrade document to 7.x https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/MigrateKVstore#Prepare_for_the_upgrade ... View more

Hi @sankardevarajan  Good luck for your exam  you can refer to  beluprint for topics wise percentage.  https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-enterprise-admin.pdf also certification track  https://www.splunk.com/en_us/pdfs/training/splunk-enterprise-certified-admin-track.pdf  you can always refer to splunk documetnation for any clarirfication however its not recomnded to use third pary material or exam dumps for passing the exam   https://www.splunk.com/en_us/resources/splunk-certification-exam-agreement.html ... View more

Hi @sabari80  Can you please verify your timezone in user prefercences   Based on your timezone prefrence alerts will run,  if timezones not in EST, kindly update them and verify under searches reports alerts    ... View more

Hi @Raja_Selvaraj  DATETIME_CONFIG = CURRENT it should work as expected. Can you please run btool command to check if DATETIME_CONFIG taking effect or any config overriding it. splunk btool props list <sourcetype> --debug   above comand should list datetime_config  sample format in props.conf  [<sourcetype>] DATETIME_CONFIG=CURRENT  ... View more

Hi @tsocyberoperati  are you seeing any permission related issues on Splunkd.log  also check splunk forwarder is running as local user or nt_ user try running splunk with local user and restart the splunk service  ... View more

Hi @moriteza  are you facing this issuse after updating deployment server to 9.2 and above? if yes.  follow thses steps.  there is known issue in Splunk 9.2.x deployment clients will not show in forwarder managment apps. you need to add following config in deployment server outputs.conf and restart deployment server [indexAndForward] index = true selectiveIndexing = true full link to issue  https://help.splunk.com/en/splunk-enterprise/administer/manage-and-update-deployment-servers/9.2/configure-the-deployment-system/upgrade-pre-9.2-deployment-servers#ariaid-title1  ... View more

Hi @sankardevarajan  you can start with following free courses provided by Splunk in STEP 1 Introduction to Splunk IT Service Intelligence 2 Installing and Administering ITSI (eLearning)   also free youtube course by Splunk https://www.youtube.com/watch?v=XAmfolPbO1E  and following two courses are paid    Using Splunk IT Service Intelligence  Implementing Splunk IT Service Intelligence     for certification there is no Prerequisite Certification for this. you can directly attempt the certification  kindly refer to blueprint for exam  https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-itsi-admin.pdf https://www.splunk.com/en_us/pdfs/training/splunk-itsi-certified-admin-track.pdf  ... View more

Hi @Praz_123  you can use rest call in moniotring console for getting inforamtion for SH and Indexers information   | rest splunk_server=<server name> services/server/sysinfo | eval "RAM GB"=round(physicalMemoryMB/1024) | table os_name os_build cpu_arch "RAM GB" numberOfCores numberOfVirtualCores transparent_hugepages.defrag transparent_hugepages.enabled transparent_hugepages.effective_state ulimits* | rename os_name as "Opeating System" os_build as "OS Build" cpu_arch as "OS Arch" numberOfCores as "Physical Cores" numberOfVirtualCores as "Virtual Cores" transparent_hugepages.defrag as "THP Defrag" transparent_hugepages.enabled as "THP enabled" you can use following rest call to run in CLI as well curl -k -u admin:changeme https://localhost:8089/services/server/sysinfo   ... View more

Hi @Jeewan  I can understand your urgecny , I dont think you can get it immedialty. I would suggest to send an email to devinfo@splunk.com. or you might need to request new license.  ... View more

Hi @SN1  telent command need to run on forwader as mentioned by @gcusello and also hope you followed stpes menioned by @livehybrid  ... View more

Hi @Wenjian_Zhu   Indexer acknowledgment will be sent after data written into the disk of indexer.  there is no relation with data replication with indexer acknowledgment acknowledgment is to let forwarders know data has been received at the indexer end and forwarder which sent data to indexer , will remove the events from the wait queue. also recommended to enable   acknowledgment at at intermediate forwader and indexer    ... View more

Hi @mahsa_nvd  Ideally its should not cause any issue for any activitys. if you still want to correct  you can raise ticket to support using  https://splunk.my.site.com/customer/s/need-help/create-case  ... View more

Hi @Nawab  Have you tried integrated using  add on and documention, this documentation helps to setup the iis logs https://docs.splunk.com/Documentation/AddOns/released/MSIIS/About  https://splunkbase.splunk.com/app/3185  ... View more

Hi @dj064  My suggestion would be not use crcSalt setting for log rotation files. Can you please disable it and restart splunk to check status. also if you can share some log files with maksing imp data   crcSalt = <SOURCE> ... View more

hi @Elbald97  In 9.4.0 KV store has been upgarded from 4.2 to 7.x, as this is a major change for KV store as per your deatils upgrade is not working in Indexers. try following link for preupgrade checks for  KV store upgarde  https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/MigrateKVstore#Prerequisites if these are indexers , KV store is not needed on them. you can disable using following on  indexers  server.conf  [kvstore] disabled=true  to aviod kv store upgarde aslong with Splunk 9.4.0 upgarde  kindly set kvstoreUpgradeOnStartupEnabled=false  post splunk upgarde you can upgarde KV store  if these are searchheads then do not disable KV store kindly refer to following documentation for mor details  https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/MigrateKVstore  https://docs.splunk.com/Documentation/Splunk/9.4.0/Installation/AboutupgradingREADTHISFIRST#Key_points_for_upgrading_to_version_9.4  ... View more

Hi @matthewroberson  ES 8.X is not yet available to download for on prem yet. Some cloud customers are in ES 8.0 Hopefully in next couple of weeks it will be available for on prem to download from splunkbase   ... View more

Hi @julienbonastre  thanks for your concern, however some of latest responses for this thread  responses posted work for this query in splunk community  also This question was posted a while ago and might not get the attention you need for your own question to be answered. I suggest you please post a brand new question so your issue can get more visibility. Anyways, I am also giving other posts  urls where it is solved. hope this helps https://community.splunk.com/t5/Splunk-Search/Replacing-quot-No-Results-Found-quot-with-quot-0-quot/m-p/304352   https://community.splunk.com/t5/Splunk-Search/How-can-I-resolve-return-0-for-quot-No-Results-Found-quot/m-p/645819  https://community.splunk.com/t5/Splunk-Search/Display-result-0-rather-than-quot-No-Results-Found-quot/m-p/511204  ... View more

Hi @apietersen  even I am seeing this for first time, howerver I would sugesst to try upgarde to 9.3.1 or 9.3.2  and Under splunk-->var--->log--->splunk  you can find migration log or splunkd.log  for any upagde realated errors  ... View more

Hi @johnnyp74  have you restarted splunk service after updating outputs.conf  and as you mentioned you did ping to check connectivity  however have you did telent on port 9997 to indexer? telnet <indexerip> 9997  in Splunkd.log have you seen any error messages, certainly splunkd.log messages help  to troubleshoot further    ... View more

Hi @smallwonder  Currently there is no option to limit data sent to splunk after reaching certian limit. you can try filter the data which i mentioned earlier post. ... View more

Hi @smallwonder  In addition to @gcusello  said If you want to reduce the data ingested into Splunk like removing some log events you can also try ingest actions. (similar to null queue)  https://docs.splunk.com/Documentation/Splunk/latest/Data/DataIngest#Filter_with_regular_expression This can be done on heavy forwarders, it's an UI based and easy to navigate. Also in case of  monitoring new log files you can try to add ignoreolderthan to avoid ingesting older  specified time. ... View more