Hello, I wanted to test UF v9.4.4 and installed it on RHEL8 and RHEL9 instances.  UF v9.4.4 seems to work in our environment and it sends logs which are searchable on Search Head. However, I can see errors in splunkd.log happening at start up. The errors are logged on start up only. RHEL9 ERROR SystemInfo [1021 MainThread] - Failed to read memory limit at location="V2:/sys/fs/cgroup:/system.slice/SplunkForwarder.service:/sys/fs/cgroup:/system.slice/SplunkForwarder.service:" RHEL8 ERROR SystemInfo [1835 MainThread] - Failed to read memory limit at location="V1:/sys/fs/cgroup/cpu,cpuacct:/system.slice/splunk.service:/sys/fs/cgroup/memory:/system.slice/splunk.s ervice:" I have done a little bit of troubleshooting: 1. tried setting selinux to 0 - no change 2. checked the permissions - splunk user has access to dirs/files mentioned in the errors 3. Checked whether the files /sys/fs/cgroup/system.slice/splunk.service/memory.max (for v2) and  /sys/fs/cgroup/memory/memory.limit_in_bytes (for v1) exist - they do exist 4. Both files have "max" in them.    I suspect this could be a bug.  Please let me know if any ideas on these errors.   EDIT: also tested with UF v9.4.5 and v10.0.0 - same errors in the logs at start up ... View more

Hello everyone, We have a distributed deployment of Splunk Enterprise with 3 indexers. Recently, it has been raising Detecting bucket ID conflicts warnings:   So far I have tried : https://community.splunk.com/t5/Splunk-Enterprise/Why-are-we-encountering-an-issue-after-a-data-migration-with/m-p/567695 https://splunk.my.site.com/customer/s/article/ERROR-Detecting-bucket-ID-conflicts   Tried renaming the conflicting bucket, moving DISABLED buckets out, combining these options and separately.  The warning is raised when a rolling restart is executed. When it is resolved on one indexer, at next rolling restart it is raised on the next indexer and so on in circles.   Please, advise. ... View more

Hello, I updated  Splunk App for Lookup File Editing from v3.6.0 to v4.0.5. After the update, when I check the Health > Logs or Health > Status it shows "Status (Old)".  I can see "Status (Old)" in lookup_editor_status.xml file. But what does that mean? What is old? Please, advise ... View more

Hi,   I am trying to update IT Essentials Work (ITEW) from v4.13.0 to v4.15.0. There is no much documentation on ITEW so I am using the documentation for IT Service Intelligence (ITSI). My understanding is ITEW is the free version of ITSI without premium features. I checked the prerequisites, updated as per the documentation  1. Stopped the service (it is a single instance - SH) 2. Extracted the new version into $SPLUNK_HOME/etc/apps 3. Started the service Then opened the app on the search head to proceed with the update, it passed the pre checks, got to    2025-02-19 14:30:56,637+1100 process:654449 thread:MainThread INFO [itsi.migration] [itsi_migration_log:43] [info] UI: Running prechecker: EAPrechecks   I left it for 30 minutes or so, then checked the status by running    curl -k -u admin:changeme -X GET https://localhost:8089/servicesNS/nobody/SA-ITOA/migration/info   and it was is_running: false Cannot see anything alarming when I check the status. Tried several times and every time it is the same. Checked the permissions, Troubleshooting documentation, restarted the service - still could not update. Please, advise ... View more

Hi, We recently upgraded the Heavy Forwarders (HF) of our Splunk Enterprise. After the upgrade the Universal Forwarders stopped sending data (e.g. Linux logs) to HFs over Http, the logs are not searchable on Search head. We upgraded from v9.1.2 to 9.3.0. We also tried 9.3.1 which did not make any difference - logs are not being sent. v9.2.3 works without issues.  I checked the logs on UF on v9.3.x and can see  ERROR S2SOverHttpOutputProcessor [8340 parsing] - HTTP 503 Service Unavailable However I cannot figure out what causes the issue. Telnet from UF to HF works, Telnet form HF to indexers also work. The tokens on the Deployment server and UFs are the same. Please, advise   ... View more