Does anyone know how does Cluster Manager populate dmc_forwarder_assets input lookup csv table? I have an issue where my UF forwarder reports show hosts with os containing repeated entries of Windows hundreds and even 000's of times. I'd like to check how this data table is being populated by CM? ... View more

Hi  We've setup the Data Model Wrangler App in our on-prem Search Head. We're running Splunk Core 9.0.3 and ES 7.0.1  The latest SA-cim-validator and CIM App are installed as per the installation notes. These apps are working as expected showing results from the validator app. I created an index from the Splunk WebUI visible under the DM Wrangler App called data_model_wrangler. We've scheduled the 3 saved searches that come with the App as per the instructions. We only see results out of 1 from the 3 saved searches from the DM Wrangler App.  Also the index created is empty. This being  data_model_wrangler_dm_index_sourcetype_field  The two other saved searches are: data_model_wrangler_field_quality data_model_wrangler_mapping_quality with errors: No results to summary index. All saved searches and indexes are enabled. Can anyone please suggest where we've gone wrong in setting this up? @nvonkorff  Thanks in advance ... View more

Hi, Does anyone out there use any archiving software to monitor, report and manage frozen bucket storage in an on-prem archive storage location? I have found https://www.conducivesi.com/splunk-archiver-vsl to fit our requirements but we are interested in looking at other options.  Thanks  ... View more

Hi All  Problem description: Search Head physical memory utilization increasing 2% per day Instance deployment: Running Splunk Enterprise Splunk version 9.0.3 using 2 Search Heads un-clustered with the main SH with this issue has allocated 48 CPU Cores | Physical Mem 32097 MB | Search Concurrency 10 | CPU usage 2% | Memory usage 57% | Linux 8.7 It is used to search across a cluster of 6 indexers. I've had Splunk look into it who reported this could be due to an internal bug fixed in 9.0.7 and 9.1.2(Jira SPL-241171 ). The actual bug fix is by the following Jira: SPL-228226: SummarizationHandler::handleList() calls getSavedSearches for all users which use a lot of memory, causing OOM at Progressive A workaround to change the limits.conf in the form of do_not_use_summaries = true did not fix the issue. splunkd server process seem to be the main component increasing it's memory usage over time. Splunk process restart seems to lower and restart the memory usage but trending upwards at a slow rate.   If anyone could share a similar experience so we can validate the Splunk support solution of upgrading to 9.1.2 based on the symptoms described above it would be appreciated. Thanks     ... View more