I am getting below error on my dbconnect, every thing was working fine HTTP Error 400, HEC response body: {"text":"Invalid data format","code":6,"invalid-event-number":15}, trace: HttpResponseProxy{HTTP/1.1 400 Bad Request [Date: Mon, 29 Sep 2025 10:35:01 GMT, Content-Type: application/json; charset=UTF-8, X-Content-Type-Options: nosniff, Content-Length: 65, Vary: Authorization, Connection: Keep-Alive, X-Frame-Options: SAMEORIGIN, Server: Splunkd] ResponseEntityProxy{[Content-Type: application/json; charset=UTF-8,Content-Length: 65,Chunked: false]}} ... View more

we have a running splunk deployment, where UFs are reading inputs from system/local and now we want to switch from system local to app/local. since both inputs and outputs have same stanzas, is it possible to remove system/local/inputs.conf using deployment server. OR we have to manually remove all. ... View more

I have a requirement where I want to see all users and their last login time, we are connected through Ldap so setting > users > last login time doesnot work.   I tried below query but it only shows lastest users not all. | rest /services/authentication/httpauth-tokens splunk_server=* | table timeAccessed userName splunk_server Also I want to know when a user was created on splunk as well, as users are created via LDAP   ... View more

I have installed ES on deployer as suggested by splunk docs, then transfered this app to /opt/splunk/etc/shcluster/apps and pushed the apps to my cluster. but still when I open ES on any search head it still says Post instal configurations and when I click configure it says you can not do it on SHC member ... View more

I have a lookuop that have domain names, I am already using this lookup in a search and its working fine, now I am trying to construct a new search based on same lookup and I get below error.   [indexer1,indexer2,indexer3,indexer4] The lookup table 'lookup.csv' does not exist or is not available. the lookup is configured to run for all apps and roles. both searches are running on ES. 1 has error and other doesnt why? ... View more

We have just upgraded to ES 8.0.2, and its is very bad or still in development stages and we want to roll back to 7.3, how can we do that keeping all our searches and notable data ... View more

I have an IIS server that is sending logs to splunk, and the logs are saved in w3c format. but I found that logs are save in UTC time format. and only IIS format can save logs in local time but there is no parser for IIs.   if someone have integrated IIS do let me know ... View more