I'm seeing hundreds of these errors in the internal splunkd logs 01-16-2025 12:05:00.584 -0600 ERROR UserManagerPro [721361 SchedulerThread] - user="nobody" had no roles Is this a known bug? I'm guessing knowledge objects with no owner defined is causing this. It's annoying because it fills the internal logs with noise. Is there an easy workaround without having to re-assign all objects without a valid owner/? ... View more

Recently our splunk security alert integration has stopped working last month (December) where we'd send an alert automatically from splunk cloud to our onmicrosoft.com@amer.teams.ms e-mail. Is the support of this being deprecated on the Microsoft side? Or is this a whitelisting issue? Anyone else experience a similar problem? ... View more

We have started to notice that since our recent upgrade to Splunk Cloud 9.2 we have been facing authentication issues where our add-ons would stop working due to authentication like "No AWS account named" or "Unable to obtain access token" and "Invalid client secret provided" for our AWS and Azure add-ons basically anything requiring Splunk to decrypt credentials stored in passwords.conf has anyone else had this problem? We're currently engaged with Splunk Support to find a root cause for this problem. I would love to know if anyone else had faced this same problem since upgrading to 9.2? ... View more

Hi, I was wondering if anyone knew how I can find the custom source types created by Data Manager Input? I had configured a custom source type or cloudwatch logs but can't seem to find it under the source types UI. Is this abstracted away somehow? How can I take a look at how this was configured under the hood?   Thanks ... View more

I've noticed a ton of "Unable to read in product version information" and "[HTTP 401] Client is not authenticated" errors lately in the splunk _internal logs. Has anyone else seen the same problem? Is this something that should be ignored? Thanks ... View more

We are getting hundreds of these errors a day in the internal logs for orig_component="SearchOperator:rest" and for app="website_monitoring" Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/data/inputs/web_ping?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. I could not find anything pointing to that IP in our website_monitoring app. Could it be something configured to point to some local endpoint, is anyone else coming across this issue?   Thanks ... View more

Hi everyone, I was wondering if anyone had any suggestions on effective ways of pulling application data from Splunk Cloud into PowerBI Platform without using the Splunk ODBC driver? Our Business Intelligence team is keen on enriching their data by integrating Splunk with PowerBI. We're aiming to ensure that this integration follows best practices and is both efficient and reliable.   Has anyone here successfully implemented this kind of integration? If so, could you share the approach you took, the tools or connectors you used, and any tips or challenges you encountered? Thanks in advance for your help! Patrick #powerbi #odbc #splunk #businessintelligence ... View more

Hello there,  We are looking to use the Custom option to send vpc flow log data to Splunk Cloud. Previously we were using the default set of fields. There's a need to ingest additional fields without using the "all fields" option in order to save on data ingest.  The issue appears to be with the Regex where the add-on cannot mix and match field names, rather it needs to be in a particular order otherwise the data is not parsed properly. Default Format: ${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} Custom Format ${version} ${account-id} ${vpc-id} ${subnet-id} ${interface-id} ${instance-id} ${flow-direction} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${pkt-srcaddr} ${pkt-dstaddr} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} This is preventing us from being able to include additional fields that can be useful to our team, without ingesting everything. Has anyone else encountered this problem before?  ... View more

I'd been intrigued about the idea, I was not able to find anything anywhere about the topic but Is it possible to use generative #AI to create Splunk#dashboards   It's a problem I have been wondering if gen AI can augment, as creating dashboards can be a very steep learning curve or tricky to get started. It's a great area that I feel AI would be super useful and I'm sure the geniuses at Splunk are already looking into! 🙂 ... View more