Attempting to bring this current.  For Splunk cloud: customers: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Admin/DataSelfStorage For Splunk enterprise with SmartStore(s3): https://docs.splunk.com/Documentation/Splunk/8.1.3/Indexer/SmartStorearchitecture https://aws.amazon.com/blogs/aws/archive-s3-to-glacier/ For Splunk enterprise without smartstore: No similar feature found.  Build your own as previously mentioned. see also (https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-put-cold-and-frozen-data-on-s3-in-AWS/) ... View more

Hi, You can try using token prefix and token suffixes as token itself. For eg. for environment , token suffix will be -$machinetype$ and for machinetype token prefix will be -$environment$. Hope this helps!!!!!!! ... View more

Deletion of the en_US dir breaks the splunk ui. There must be some other dependency that the UI requires from the en_US directory. "Error connecting: Connection refused" ... View more

Awesome. Thank you. The fact that Splunk passes one single argument to the script and what that argument is does not seem to be documented anywhere which is the type of information I was looking for when I mentioned the API of that script hook. ... View more

Nope. I removed the trigger from the category dropdown and it seems that the host dropdown is still updated when I change it (Which is nice) but the graphs still do not update on category changes if the host was * before the change ... View more