“After upgrading Splunk to 10.2, the apps are no longer usable. May I know if there are any methods to collect PRTG logs, or will the app be updated?” ... View more

I am using the Splunk Add-on for Microsoft Cloud Services to retrieve Event Hub data in Splunk Cloud, but I encountered the following error in the internal log. 2025-07-09 02:16:40,345 level=ERROR pid=1248398 tid=MainThread logger=modular_inputs.mscs_azure_event_hub pos=mscs_azure_event_hub.py:run:925 | datainput="Azure_Event_hub" start_time=1752027388 | message="Error occurred while connecting to eventhub: Failed to authenticate the connection due to exception: [Errno -2] Name or service not known Error condition: ErrorCondition.ClientError Error Description: Failed to authenticate the connection due to exception: [Errno -2] Name or service not known The credentials should not be an issue, as I am using the same credentials in FortiSIEM and successfully get the data from event hub. Could anyone help identify the cause of the issue and suggest how to resolve it?   ... View more

I am using Enterprise 9.3.2, ES 8.1.0, and SOAR 6.4.1 to test the pairing function. Both devices are on-premises and in the same subnet, with no network issues between them. However, when I try to use the pairing function in ES, the following error message appears: "Cannot connect to SOAR. Check that the ES IP address is included on the SOAR stack allow list." When I check the internal log, it shows the following error: "Unexpected error when attempting pairing: HTTPSConnectionPool(host='xxx.xxx.xxx.xxx', port=8443): Max retries exceeded with URL: /rest/version (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1143)')))". Does anyone have any ideas on how to resolve this? ... View more

We found that the search job size becomes extremely large during searches. My Splunk instance is a newly installed testing lab with the following limits.conf only. Anyone else have any idea on this situation? /opt/splunk/etc/system/local/limits.conf [search] read_final_results_from_timeliner = 1 Update: When I change the read_final_results_from_timeliner = 1 to read_final_results_from_timeliner = true The Job size reduced and I don't know why.     ... View more

I am trying to remove everything before the { character to preserve the JSON format. I am using SEDCMD-keepjson = s/^[^{]{/{/ in the sourcetype configuration, but it fails to apply correctly. However, when I use the search command | rex mode=sed "s/^[^{]{/{/", it successfully removes the unwanted text. I am wondering what could be causing this issue. The sourcetype settings are configured on both the Search Head (SH) and Heavy Forwarder (HF) Mar 28 13:11:57 abcdeabcdev01w.abcdabcd.local {<json_log>}   ... View more

I am using Heavy Forwarder to forward log to Splunk cloud, when I installed the splunkclouduf.spl to splunk  autoloadbalancedconnectionstrategy cooked connection to xxx.xxx.xxx.xxx:9997 May I know the IP address of Splunk Cloud Indexer and Search head are fixed or changeable?  And for the firewall rule, should I use IP address or DNS to allow the traffic? ... View more

We received all alerts from Splunk Cloud with sender [email protected]. Can we change the sender to other domain? E.g. [email protected] Do we need to raise a support ticket to have a change request on it?   ... View more

I have both Chinese and English field names from the Windows event log, and I would like to use field aliases so that the English field names can search for both the Chinese and English fields. However, I found that some fields, such as src and src_port, are missing for the Chinese field. This issue might be related to the fact that field aliases take effect only after EXTRACT, REPORT, or LOOKUP. Does anyone have suggestions on how to effectively convert between Chinese and English field names? (The only thing I can do is on the SH; I am not allowed to change the other instance.)   ... View more

After upgrade from 9.3.1 to 9.4.0 in windows platform, there is a warning shows 41 files that did not match. After validate files, it shows the following query. How to solve the warning? C:\Program Files\Splunk\bin>splunk.exe validate files Validating installed files against hashes from 'C:\Program Files\Splunk\splunk-9.4.0-6b4ebe426ca6-windows-x64-manifest' Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-console-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-datetime-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-debug-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-errorhandling-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-file-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-file-l1-2-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-file-l2-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-handle-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-heap-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-interlocked-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-libraryloader-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-localization-l1-2-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-memory-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-namedpipe-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-processenvironment-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-processthreads-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-processthreads-l1-1-1.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-profile-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-rtlsupport-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-string-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-synch-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-synch-l1-2-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-sysinfo-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-timezone-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-core-util-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-conio-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-convert-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-environment-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-filesystem-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-heap-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-locale-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-math-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-multibyte-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-private-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-process-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-runtime-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-stdio-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-string-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-time-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/api-ms-win-crt-utility-l1-1-0.dll': The system cannot find the file specified. Could not open 'C:\Program Files\Splunk\bin/ucrtbase.dll': The system cannot find the file specified.   ... View more

Our MySQL server was upgraded from 5.7 to 8.0.37, and the MariaDB plugin no longer supports exporting audit log files. Are there any methods to export audit logs in a Windows environment? ... View more

I want to receive Keycloak logs in the Splunk Cloud platform. I found Keycloak apps in Splunkbase, but they seem to be unavailable in Splunk Cloud. Are there any methods to receive Keycloak logs in Splunk Cloud? ... View more

Hi all, I am experiencing an issue with the Splunk WinHostInfo input. It is not working after being deployed to the universal forwarder, whereas the other logs from the same device are successfully received. Does anyone have any idea or suggestions on how to resolve this? ... View more