Installation by domain admin with current UF fails on the domain controller with error 1603 and there are additional loglines that may be usefull: MSI (s) (F0:34) [08:38:07:344]: Note: 1: 1708 MSI (s) (F0:34) [08:38:07:344]: Note: 1: 2205 2: 3: Error MSI (s) (F0:34) [08:38:07:344]: Note: 1: 2228 2: 3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1708 MSI (s) (F0:34) [08:38:07:344]: Note: 1: 2205 2: 3: Error MSI (s) (F0:34) [08:38:07:344]: Note: 1: 2228 2: 3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709 MSI (s) (F0:34) [08:38:07:344]: Product: UniversalForwarder -- Installation failed. MSI (s) (F0:34) [08:38:07:344]: Das Produkt wurde durch Windows Installer installiert. Produktname: UniversalForwarder. Produktversion: 9.3.0.0. Produktsprache: 1033. Hersteller: Splunk, Inc.. Erfolg- bzw. Fehlerstatus der Installation: 1603. I thought I would attach the complete log for examination, unfortunably not possible here.  Up to the showed lines everything is running good, no hint of missing permissions etc. Any help is appreciated, our project depends on it. ... View more

Still doesn't work. I really don't understand what the problem is with my search when it parses correctly in the search app, but fails in the new suppression wizard. ... View more

Thanks for the hint. This might do it for some environments, but I just can't get why SSL validation is not available for this output. It's http traffic, otel hec output does it, fluentd hec output does it, but UF doesn't support it? ... View more

Splunk docs specify that you cannot monitor Windows event log (*.evt) files with a [monitor://] stanza as they are in binary format. The splunkd service monitors these binary files by using the appropriate APIs to read and index the data within the files. Not really sure if you can monitor the archived logs, but maybe try modifying the following stanza from the docs for the archived logs and see if it helps.  Use the Full Name log property in Event Viewer to specify complex Event Log channel names properly You can use the Full Name Event Log property in Event Viewer to ensure that you specify the correct Event Log channel in an inputs.conf stanza. For example, to monitor the Task Scheduler application log, Microsoft-Windows-TaskScheduler-Operational, do the following steps: Open Event Viewer. Expand Applications and Services Logs > Microsoft > Windows > TaskScheduler. Right-click Operational and select Properties. In the dialog that appears, copy the text in the Full Name field. Append this text into the WinEventLog:// stanza of inputs.conf as in the following example: [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] disabled = 0 More information on the same: https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/MonitorWindowseventlogdata ... View more

In that case, @HemanthShekar, you must modify your Splunk search query to return the results as a single JSON object. Use the stats command to aggregate the results and return them as a single JSON object in your search query. Here's an example: GET /services/search/jobs/export?output_mode=json&search=search+index%3D*+earliest%3D-24h%40h+latest%3Dnow+|+stats+values(status_code)+by+status_code&count=1000 This will return the count of each status code value as a single JSON object, which your Java middleware can quickly parse. You can modify the search query to meet your specific needs. ... View more