Hello,   I am performing Splunk UF installation of version 8.0.5 and getting following error logged in error logs: ==> splunkd.log <== 08-23-2022 10:00:29.018 -0400 WARN TcpOutputProc - Pipeline data does not have indexKey. [_conf] = |||\n 08-23-2022 10:00:29.018 -0400 WARN TcpOutputProc - The event is missing source information. Event : no raw data I am not sure what is this error means. I can see that sources defined in config files are sending logs to Splunk. Could someone suggest how I can fix these errors to make sure no data lose there? ... View more

Hello, I am trying to install latest version of Splunk universal forwarder using chef cookbook and getting error. Earlier in version 6.5.0, once rpm installed using rpm -ivh splunkuniversal-xx.rpm, I used to run command as: /splunkuniversal/bin/splunk enable boot-start --accept-license --answer-yes and then change the password /splunkuniversal/bin/splunk edit user admin -password xxxxx -roles admin -auth admin:xxxxxx service splunk start but now in version 8.2.6, after rpm install, when I am trying to run above commands, it is asking to create user. Is there any change in installation process and how I can automate it again via chef cookbook so hat it should not prompt for user creation ? Regards, Dhimanv ... View more

Hello,   We are using Splunk HEC token to receive the EKS logs in Splunk. The EKS monitoring container of Splunk have docker.io/splunk/fluentd-hec:1.2.5 version running. We want to upgrade Splunk to version 8.2.7 from Splunk 8.0.5 and want to know if docker.io/splunk/fluentd-hec:1.2.5 version of container is compatible with our Splunk version 8.2.7 or not? ... View more

Hello,   I am getting error below when trying to search the data in Splunk SearchHead: ERROR SearchScheduler - The maximum number of concurrent historical searches for this user based on their role quota has been reached I tried to change the parameters as below scheduler max_searches_per_cpu from 25 to 50 search max_searches_per_cpu from 6 to 10 But too seems not working and even generating high LOAD. Could you please suggest how I can fix this issue? I am using Splunk Enterprise 8.0.5 version (I know its out of date  but still need help to figure out issue to plan upgrade) ... View more