Hi @pm2012  you can use following query index=_internal source="*license_usage.log" type=Usage h="<forwader name>" | rename _time as Date | eval Date=strftime(Date,"%b-%y") | stats sum(b) as license by Date h | eval licenseGB =round(license/1024/1024/1024,3) | rename licenseGB as TB ... View more

Hi @uagraw01  it seems ,533 is milliseconds 2023-12-05T04:21:21,533+00:00 %Y-%m-%dT%H:%S,%3Q+00:00 ... View more

Hi @syazwani  please follow below steps to reset password go to  <SPlunk installation directory>/splunk/etc/  under this location file called passwd  rename it to passwd.backup  go to following location  <SPlunk installation directory>/splunk/etc/system/local create new file user-seed.conf  inside user-seed file  add following contents  [user_info] USERNAME = admin PASSWORD = <newpassword> and restart splunk from cmd  <SPlunk installation directory>/splunl/bin/ splunk restart  ---- Regards, Sanjay Reddy ---- If this reply helps you, Karma would be appreciated ... View more

Hi @Colloh  I would suggest you to open in incognito or clearer your broswer cookies and loginto STEP this would be temporary issue  ... View more

Hi @iamsplunker  from inputs.conf and log file last modified, there is an issue I see  as log file modified last month and in inputs.conf you mentioned ignoreOlderThan = 7d  Splunk will ignore log files which are modified more than 7 days ago. I would suggest comment ignoreOlderThan = 7d  for first time and restart splunkd ,  once splunk reads older file then you can comment again. ... View more

Hi @sarit_s  chart command will not work with multiple fileds , try using stats  ... View more

Hi @sivakrishna  instaed of changing rhe port, if 8191 is already used by splunk then please kill  and start the splunk have you checked which process using 8191 , if you wan the change the port , you need to change port on rest search heads, which is not recomended  ... View more

Hi @sivakrishna  it seems KVstrore port 8191 is used by other application. can you check which process using 8191 port , ps -ef | grep -i 8191  if is used by other application check with os team to check and ask them use other port,  then you can start splunk and kvstore will start on port 8191 ... View more

Hi @AmirSA  can you try accessing following URL to view certifications  https://splunk.my.site.com/customer/s/list-views/certifications      ... View more

Hi @gebr  As 8.0.x no longer supporrted by splunk as per support policy from  https://www.splunk.com/en_us/legal/splunk-software-support-policy.html#core  I would suggest to upgarde your infra to last version of Splunk. e.g 9.0.x.  if you are not able to upgrade for sometime ,  may be i would suggest to go for 8.0.1 splunk UF  or same version as HF/Indexer  you can download from older version from https://www.splunk.com/en_us/download/previous-releases-universal-forwarder.html  ... View more

Hi @BoldKnowsNothin  Did you see any warning/error messages in splunkd.log for file you intially monitored.  log messages in splunkd.log will help to troubleshoot furthur ... View more

Hi @michael_vi  for monotoring forwarders, no configuration is required from forwarders side. in the  moniroting console MC > settings> Forwarder moniroting setup ---> forwarder monitoring--->enable and save after sometime in MC > Forwarders > Forwarders: Deployment shows the forwarders list and their health. P.S: deployment sevrer can not monitor forwarder health ... View more