Hi everyone, I’m testing SPL2 for the first time after upgrading our Splunk deployment from 10.0 to 10.2.1, and I’m seeing behavior that looks very different from SPL1. When using index=* | stats count by index in spl1 we can access all the indexes available on our indexer-cluster.  Using similar query with spl2 returns only 13. All the indexes that spl2 returns appears as "internal", so it's ES indexes and all "_*" indexes. Trying to search available in spl1 index, for example: index=aws results in error: Error in 'SearchParser': The SPL2 query is invalid: 'Unable to find any index datasets matching search expression: 'index="aws"'. It's possible that they exist, but you are not authorized to access them. Contact your administrator.'. We are using single Search Head with Indexer Cluster. ... View more

Hello Splunk Community, We are currently evaluating different options for integrating Google Workspace with Splunk and would appreciate your guidance on which approach might be the most effective and sustainable. The options we are considering are: Splunk App for Google Workspace (App 5498) Splunk App for Google Workspace (App 5556) Integration via GCP BigQuery → Pub/Sub → Splunk We initially tested the first option (App 5498), but we encountered limitations related to the number of API requests, which makes this approach less convenient for our needs. Because of this, we are exploring the other options. Has anyone had experience comparing these approaches? Which method would you recommend in terms of scalability, performance, and long-term maintainability? Thank you in advance for your insights. ... View more

Hello there! I am currently managing a Splunk Enterprise clustered environment, where I have implemented a scheduled search that runs every 5 minutes to maintain and update two CSV lookup files. These lookup files are currently stored in the designated lookups directory on the Search Head. My objective is to develop a custom application using the Splunk Add-on Builder, which will incorporate a Python script that will be executed on the Heavy Forwarder. This script requires access to the updated lookup data to function properly. However, due to the clustered nature of my environment, directly accessing these CSV files from the filesystem through the script is not an option. Ideally, indexers should also have access to the same lookup data as both SH and HF. Are there any potential methods or best practices for establishing a reliable mechanism to push or synchronize these lookup files from the SH to the HF (and Indexers, if possible)? Perhaps there are some recommended approaches or established methodologies to achieve reliable sync of those lookup files in a clustered environment that I haven’t found? ... View more

Hi! Is there any way to make data retrival rate slower? Something like 1h worth of data every 1m When we are trying to save 30D data from our elastic(about 4.4m events) server makes huge network load spike and then stops responding. ... View more