The Credentials used to connect the Splunk TA for Azure was set to expire in 6 months from now. I would like to get an alert created for that in Splunk so we can update this a week before it expires so it does not take us by surprise. I do not want to set a personal reminder just in case someone else is in the role by then. Thanks for your help.   ... View more

After disabling the Splunk readiness app due to a vulnerability recommendation, i restarted my search head which had the KV store. Once i restarted, the splunkd started with no error but the search head web interface will not come back on. Apart from the app change, nothing else has changed. Any recommendations on how to address this?  search peer XXXXX has the ollowing message KV store changed status to failed. An error occurred during the last operation (‘getServerVersion’,domain ‘15’ code ‘13053’) No suitable servers found(ServerSeectionTryOnce Set) connection closed calling ismaster on XXXXX:8191 Thank you ... View more

I am trying to ingest Linux logs into Splunk.  1. I have deployed the unix_TA through the deployment server to the Heavy forwarder and to the universal forwarder with the inputs. conf defined in the Local directory. The indexes are defined in the inputs.conf as well. 2. The Universal forwarder has confirmed that the TA is found in the /opt/splunkuniversal forwarder/apps directory with the inputs.conf as deployed. 3. permissions have been granted to the Splunkfwd on the universal forwarder on the Linux server to read var/log . 4. The TA is also installed on the Search Head. I am able to see the metric logs in the _internal index. However I do not see the event logs. I have run a tcp dump on the heavy forwarder's CLI  and have confirmed that there are logs coming in. Any ideas on what I am missing? ... View more