Hi Splunkers, I'm trying to figure out the easiest way to monitor  Kubernetes in Splunk Core. I did a little research and found the Splunk App for Infrastructure (SAI), but it seems to be outdated. In your experience, what's the best way to get the data in? (Otel?) And do you know of an app that comes with preconfigured dashboards etc. for this use case? Thanks in advance! ... View more

Hi Splunkers, this might be a dumb question but I am a bit confused in regard to ITSI licensing. I understand that ITSI requires an ingest of at least 50GB as well as a separate ITSI license in addition to the Splunk Core license. Does that mean a 50GB Core license and a 0GB ITSI license? Or could you get a 0GB Core license (like you would use on a HF that doesn't ingest anything) and a 50GB ITSI license?  And can both be installed in the same place in the GUI of the license master or is there a special process for the ITSI license? ... View more

Hello Splunkers, Can somebody here tell me what the easiest way is to get MuleSoft data into Splunk if the MuleSoft data is on-prem? For example, would I be able to use a forwarder and monitor the directory, or is an integration via HEC or API possible? I also found an add-on and an app, but it doesn't say whether they're intended for MuleSoft running on-prem or in the cloud. Any help would be greatly appreciated!! ... View more

Hi everyone, I'm on Victoria experience and want to perform a self-installation of the following app: Microsoft Sentinel Add-On for Splunk. However, I cannot see the app in the list for self-installation. How can I get this installed? ... View more

Hello! My question is: When I send logs into the Splunk Cloud platform, where exactly do they go? Are they also stored in buckets on an indexer, and if so, how many indexers? ... View more

Hi Splunkers, I am experiencing issues with an index cluster and it would be great if you could help me out. Every time I change or create an index a restart is required and it takes up to an hour until all the indexers are ready again. This used to work without a restart and only started happening after an upgrade at some point. I found this, but that doesn't say anything about creating indexes. Do you have an idea where this is coming from exactly and if it can be avoided in some way? Since changes are made weekly, it is really annoying. ... View more