I'm also having a similar problem. The "user menu" for my Splunk UI is simply not there. With this being the case, I'm not able to change my preferences or simply logout. Any help would be greatly appreciated.  ... View more

You might also want to give a try to logcraft.io you can version knowledge objects individually and deploy them where you want, that's repository for splunk ... View more

Hi @glpadilla_sol, some question to better understand the situation: at first, have you this kind of problems only on this UF? if yes, should this UF send many logs? could you have some network congestion problem in the netweork segment between the UF and Indexers? please try to modify the following parameters on UF's server.conf: [queue] maxSize = 10MB and UF's limits.conf maxKBps = 2048 in this way you enlarge the dimension of the UF queue obviously with following UF's Splunk restart Ciao. Giuseppe ... View more

Hello I have the same issue but using href for example: </div> <div style="float:right"> <a href="/app/search/request_alert?form.reporter_token=$reporter$ class="btn btn-primary" target="_blank">Request</a> </div> I need to pass the token $reporter$ as it is, without being encoded. Thanks. ... View more

This was something odd. After a lot of troubleshooting I decided to restart the Splunk service of the Heavy Forwarder, where the dbconnect was configured.   And after that I started receiving the logs and the issue not there anymore. ... View more

Base searches are really intended to reuse aggregations rather than just bring a whole load of data into the dashboard like your example here. Unless you use an aggregation there is a 500,000 event limit I believe and I have found some strange bad performance behaviour when trying to do this. You should craft base searches carefully, considering how they can be used. Without seeing the other searches, it's hard to say whether your example makes sense as a base search. As to why you are seeing those extra fields * statements, I can't say. So, as a recommendation - using base searches just to try to 'cache' events, is bad practice, I've rarely found a good need for that For example, if you have two searches, one needing count by host and the other needing count by sourcetype, then a sensible base search would be index=x | stats count by host sourcetype and the appropriate post-process searches would be | stats sum(count) as count by host AND | stats sum(count) as count by sourcetype   ... View more

As I said before, splunk unpacks the archive file and ingests all unpacked files. That's how it works. The assumption is that you have your logs ready, just packed. The whitelist/blacklist logic works at the level of choosing which file to unpack, not which unpacked file from within the archive to ingest. ... View more

In technical point of view it's quite expensive operation to move especially memory to one VM to another. This has huge performance effects for Splunk VMs and it's not a recommended configuration for Splunk VMs. Here is couple of old answers related to this. If I recall right there is also some White paper or other technical documentation about running Splunk on VMware, but I cannot found those now. https://community.splunk.com/t5/Splunk-Search/Configure-a-Vsphere-VM-for-Splunk/td-p/409840 https://community.splunk.com/t5/Monitoring-Splunk/Running-Splunk-on-a-VM-CPU-contention/m-p/107582 ... View more

Hello @VatsalJagani thank you for the input. Yes, this concern was because a couple of weeks we had some alerts about memory usage in one search head (root cause a user running hard searches), but during the troubleshooting we notice that we have A LOT of unused memory just sitting unallocated on our servers that are hosting the VMs, we want to use them but first we want to be sure that is not going to generate further issues at the environment. Ok regarding the indexers I have noticed some issues with IOWait and I have try to identify the root cause but no luck there I created this post a few months ago: https://community.splunk.com/t5/Splunk-Enterprise/IOWait-Resource-usage/m-p/578077   So for now I can think there are not issues adding memory to the search heads. Kind Regards. ... View more

Thank you so much! ... View more

Hello, Did you get an answer for this? One of my clients is having the same issue. Only the captain is skipping all the searches they have a lot of resources in their environment. Also we set up this captain_is_adhoc_searchhead=true But that didn't help.   Kind Regards. ... View more

I'd treat this check as more of a "sanity check" than a really technical one. There is no real technical cons against having those sourcetypes. It's just that if you push many different sourcetypes into a single index, maybe it's a situation in which you'd like to split them into different indexes because the data in those sourcetypes is of completely separate types, uses and so on and you're gonna suddenly discover one day that you might want to limit access to only one of them. That's all. Another situation where this would be worrying is if the data was getting into that index in an uncontrolled manner - as a default main index or if it was your last resort index. ... View more