Could you please share the sample raw logs and how are those looking in Splunk once they are ingested? Issues with Line breaking, timestamp assignment, field extraction? ... View more

You can disable those integrity checks as well if your Splunk environment is working fine after upgrade. To disable the file integrity check, edit the installed_files_integrity setting in the limits.conf file ... View more

Let me now if below query helps - | makeresults count=3 | streamstats count as field1 | eval field2=field1+0 | eval field2=if(field2=3, Null(), field2) | fields - _time | eval field3=if(field1==field2, null(), field1)     ... View more

As per above table, considering Time as _time and # of events as count, Please try below query - | search count=0 | stats first(count) as count by _time Let me know if this is what you're aiming to achieve. ... View more

In theory and as a best practice it should but it is unlikely that all the DC will be on same version as DS unless all the best practice are followed. Either it will be on same or lower version than DS. ... View more

Can try this setting if it helps - syslogseverity severity OUTPUTNEW severity AS severity_auto severity_desc Please refer to https://community.splunk.com/t5/Splunk-Cloud-Platform/Why-can-I-not-expand-lookup-field-due-to-a-reference-cycle-in/m-p/563011/highlight/true#M1055 ... View more

I agree with Giuseppe as the suggestion is good to start with. However, in MLTK you can use the outlier detection example shipped with the app. Can created a search split by source which will show the sources responsible for the data growth as an outlier. ... View more

Try this regex - Student.*?country\"\:\"(?<country>[\w]+)\"   ... View more

There is no requirement in scanning the deployment-apps folder as those apps are anyways going to get deployed on the deployment clients and can be scanned while upgrading the deployment client. The compatibility issue with the Splunk version won't exist when the app is present in the deployment-app folder. I hope this helps. ... View more

Can check from the Azure end. Refer https://techcommunity.microsoft.com/blog/azurepaasblog/public-access-is-not-permitted-on-this-storage-account/3521288 ... View more

I see those error in both web ui and _internal ... View more

I'm afraid to say I removed the inputs last week but still I can see errors in last 15 minutes ☹️ ... View more

There is no significance of MSCS inputs when I output the content from "splunk show config inputs" still the error is present. This is very strange. ... View more

Have you installed AWS TA and Splunk Add-on for Amazon Kinesis Firehose for parsing? Document ... View more

MSCS TA uses service principle for authentication. Please review below document to configure and connect with TA with the same - https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/ConfigureappinAzureAD/ ... View more

Yes, I have already checked the btool output. Nothing shows up when I run the command as the inputs.conf are removed. ... View more

I have experience working with Ingest Actions. However, I was reading about Ingest Processor which I guess is not different than the ingest actions in terms of functionality. Both does configure data flows, control data format, apply transformation rules prior to indexing, and route to destinations. Major difference I see is Ingest actions configs are present in props & transforms on HF/Indexer level while the Ingest Processor is a complete cloud solution which comes into action between HF layer and Splunk cloud indexer layer that has separate UI solution for configuration. ... View more

It's the MSCS and google TA. On SHC, inputs.conf are removed from default and local still the error appears as below on all the members. ERROR ModularInputs [1990877 ConfReplicationThread] - Unable to initialize modular input "mscs_storage_table" defined in the app "splunk_ta_microsoft-cloudservices": Introspecting scheme=mscs_storage_table: script running failed ... View more