Has anyone successfully deployed MCP server with Splunk Enterprise in a production environment? If so how would you handle Multi-Team Access , RBAC & Integrations with VS Code Augment/claude etc. I have fair bit of an idea but looking for some standard solution if its implemented . ... View more

We have logs already in CloudWatch. What is the best way to take the logs from cloudwatch to splunk on prem. We have a vpn established too between them . So based on this any Add ons or other viable solution other than Add ons. If yes : Any details /steps etc. ... View more

Environment: Product: Splunk Enterprise (Indexer) Deployment: On-premises Current Version: 9.3.2 Target Version: 9.4.x (tested 9.4.0, 9.4.2) Current KV Store Version: MongoDB 4.17 Expected KV Store Version: MongoDB 7.x (per documentation) Issue Summary: Experiencing KV Store upgrade failures when upgrading Splunk Enterprise Indexer from 9.3.2 to any 9.4.x version. According to Splunk documentation, the upgrade from 9.3.x to 9.4.x should be seamless with automatic KV Store upgrade from MongoDB 4.x to 7.x. Both automatic and manual KV Store upgrade approaches have failed. Errors sample: -  alled Result::unwrap() on an Err value: UpgradeError { details: "Error updating status to 'INITIAL_UPGRADE_SEQUENCE' on 127.0.0.1:8191 document: Error { kind: Write(WriteError(WriteError { code: 11000, code_name: None, message: "E11000 duplicate key error collection: migration_metadata.migration_metadata index: id dup key: { _id: \"127.0.0.1:8191\" }", details: None })), labels: {}, wire_version: None, source: None }", kind: LocalError } - Failed to upgrade KV Store to the latest version. KV Store is running an old version, 4.2. Resolve upgrade errors and try to upgrade KV Store to the latest version again. Any others wiredTiger etc all might be wild fire and relevant Tried manuallay and also ansible automation both( same steps )   Question: Why is KV Store upgrading to 4.25 instead of directly to 7.x as documented? How to come out as we have big infra and we need to upgrade etc ? ... View more

I'm working on observability tooling and have built a MCP bridge that routes queries / Admin activities for splunk along with several other tools . How do i get if their is some existing MCP's built already for splunk and move way ahead? Happy to collab! ... View more

I'm currently working on integrating Splunk with AWX to monitor Ansible automation jobs. I'm looking for guidance on the best practices for sending AWX job logs to Splunk. Specifically, I'm interested in: Any existing plugins or recommended methods for forwarding AWX logs to Splunk. How to differentiate logs from QA and production environments within Splunk. Examples of SPL queries to identify failed jobs or performance metrics. Any advice or resources you could share would be greatly appreciated. Thanks. ... View more

Hi, The AppD ansible collection for machine agent has an issue where if you want to change the values of tier, application, or node_name but they already have values in the conf file, you cannot change them without first uninstalling and then re-installing the agent. I can't give a link to the git repo, because the Ansible collection does not expose which git repo the collection was synced from. The collection page is https://galaxy.ansible.com/ui/repo/published/appdynamics/agents/, which also contains a tarball of the code. This specific code is both: roles/java/tasks/merging-controller-info.yml (starting line 98) roles/machine/tasks/merging-controller-info.yml (starting line 108) I can submit a PR for this if you point me to the git repo for it, or I would request that it either. Any suggestions or a way through? ... View more