Hello, I received this same error in upgrading from 9.3 to 9.4 versions of Splunk Enterprise.  I found a helpful article posted by Splunk Support that resolved my issue.  Please see the link below.   http://splunk.my.site.com/customer/s/article/File-Integrity-checks-found-41-files-that-did-not-match-the-system-provided-manifest  ... View more

Could you please share the sample raw logs and how are those looking in Splunk once they are ingested? Issues with Line breaking, timestamp assignment, field extraction? ... View more

The desired result is to send alerts for all events > 0 and only once for alert that has 0 for the first time: Scheduled alerts: Time 0 5 10 15 20 25 30 35 40 45 50 55 0 5 10 15 20 25 30 # of Events 3 4 0 0 0 8 15 2 0 5 55 66 0 0 0 0 0 8 9   Desired output, i.e. the alert that I want to receive Time 0 5 10 25 30 35 40 45 50 55 0 25 30 # of Events 3 4 0 8 15 2 0 5 55 66 0 8 9   Is there a configuration that I need to activate in alerts box? Or is there something else that I'm missing?     ... View more

As per error logs it seems that public access for the storage account overrides the public access settings for all containers in that storage account, preventing anonymous access to blob data in that account. When public access is disallowed for the account, it is not possible to configure the public access setting for a container to permit anonymous access, and any future anonymous requests to that account will fail.   To set the AllowBlobPublicAccess property for the storage account, a user must have permissions to create and manage storage accounts. Azure role-based access control (Azure RBAC) roles that provide these permissions include the Microsoft.Storage/storageAccounts/write action. Built-in roles with this action include: The Azure Resource Manager Owner role The Azure Resource Manager Contributor role The Storage Account Contributor role Once you have an account with such permissions, you can work your way through any of the following ways to enable the "Blob public access" setting on your Storage Account: After that you can also set the public access setting at the container and blob levels: This above information will help you to resolve this issue   ... View more

I agree.  My last environment I managed had UF versions ranging from high 6.x to low 9.1.x.  Any upgrade readiness scans would lite up like a Christmas tree looking at the DS folder. ... View more

Can try this setting if it helps - syslogseverity severity OUTPUTNEW severity AS severity_auto severity_desc Please refer to https://community.splunk.com/t5/Splunk-Cloud-Platform/Why-can-I-not-expand-lookup-field-due-to-a-reference-cycle-in/m-p/563011/highlight/true#M1055 ... View more

I agree with Giuseppe as the suggestion is good to start with. However, in MLTK you can use the outlier detection example shipped with the app. Can created a search split by source which will show the sources responsible for the data growth as an outlier. ... View more

Try this regex - Student.*?country\"\:\"(?<country>[\w]+)\"   ... View more

Have you installed AWS TA and Splunk Add-on for Amazon Kinesis Firehose for parsing? Document ... View more

I have experience working with Ingest Actions. However, I was reading about Ingest Processor which I guess is not different than the ingest actions in terms of functionality. Both does configure data flows, control data format, apply transformation rules prior to indexing, and route to destinations. Major difference I see is Ingest actions configs are present in props & transforms on HF/Indexer level while the Ingest Processor is a complete cloud solution which comes into action between HF layer and Splunk cloud indexer layer that has separate UI solution for configuration. ... View more