Hi,  We upgraded Splunk from 8.2.6 to 9.0.1 recently and have one big internal app ( dashboard, views, field extractions) which is failing dring app readiness check. It shows that app is using python 2 and not compatible with python3 . Either uninstall it or update it.  How do i update this internal app ( this is not splunk app , builder or plugin) - is there any documentation or steps which anyone can provide.      ... View more

Hi ,   Some users are seeing this error while running search query "Invalid_adhoc_search_level" - issue is intermittent.  Did someone else faced similar issue . If yes, why is it happening and how to fix it.  Splunk version - 8.2.6   ... View more

We are trying to upgrade search head from 8.0.1 to 8.2.6 but we are getting error Splunk setup wizard ended prematurely.   We tried the solution mentioned on below community post but it didnt worked either "Splunk Enterprise Setup Wizard ended prematurely"... - Splunk Community Please find below snapshot for the same- ... View more

Hi , I am facing a weird issue - where on a Splunk indexer I am trying to filter out log events using props and transforms file.  I have noticed that filtering of log events works perfectly fine for sourcetypes which are not defined or do not exsist in Splunk default config. For example Okta, Jenkins,fluentd etc. As soon as I try to filter IIS/Catalina sourcetype - it never works .  For example this is my props - which is filtering journald sourcetype but not iis Props  [iis] TRANSFORMS-routing = setnull [journald] TRANSFORMS-routing = setnull Transforms  [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue   ... View more

Hi,   I am trying to filter out events using props.conf and transforms.conf . I have requirement where there are multiple source log files are present and I need to pick few of them , like ( i can't use host or sourcetype as they are been shared with other indexes) - source1: ABC/DEF/IJK-YTL/master/dev/jobid18/console source2: ABC/DEF/IJK-YTL/master/dev/jobid19/console and so on .  I have tried following regex but they didnt work ( i still see logs been indexed and not dumped)  props.conf [source::ABC/DEF/IJK-YTL/master/dev/.*?/console] TRANSFORMS-set = setnull OR  option 2 : [source::\ABC\/DEF\/IJK-YTL\/master\/dev\/.*?\/console] Option 3 : [source::.../console] Option 4 : [source::...[/\\]master[/\\]...[/\\]console] Transforms.conf  [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue Can someone please help - SPlunk is on windows platform   ... View more