Hi Splunk Community & Splunk Docs team, Splunk Enterprise 9.4.7 was released on November 26, 2025 (fixed issues page is already live): https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/release-notes/9.4/fixed-issues/fixed-issues/splunk-enterprise-9.4.7-fixed-issues However, the official Splunk Products Version Compatibility Matrix still only lists up to 9.4.6 and does not include 9.4.7: https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates/compatibility-matrix/splunk-products-version-compatibility/splunk-products-version-compatibility-matrix We are in the final planning stage of a large SOC migration/upgrade and this specific gap is currently blocking sign-off because leadership requires the version to be explicitly present in the compatibility matrix (especially for Splunk Enterprise Security, CIM Add-on, and SOAR integrations). Questions: 1. Is it safe to assume that 9.4.7 inherits exactly the same compatibility as the rest of the 9.4.x line (no changes introduced in 9.4.7)? 2. When can we expect the compatibility matrix to be updated to include 9.4.7? 3. Is there any official statement or internal ticket we can reference in the meantime? Any clarification from Splunk employees, docs team, or MVPs would be greatly appreciated. Thank you! ... View more

Description: I am using a Splunk Heavy Forwarder (HF) to forward logs to an indexer cluster. I need to configure props.conf and transforms.conf on the HF to drop all logs that originate from a specific directory and any of its subdirectories, without modifying the configuration each time a new subdirectory is created. Scenario: The logs I want to discard are located under /var/log/apple/. This directory contains dynamically created subdirectories, such as: /var/log/apple/nginx/ /var/log/apple/db/intro/ /var/log/apple/some/other/depth/ New subdirectories are added frequently, and I cannot manually update the configuration every time. Attempted Solution: I configured props.conf as follows: [source::/var/log/apple(/.*)?] TRANSFORMS-null=discard_apple_logs And in transforms.conf: [discard_apple_logs] REGEX = . DEST_KEY = queue FORMAT = nullQueue However, this does not seem to work, as logs from the subdirectories are still being forwarded to the indexers. Question: What is the correct way to configure props.conf and transforms.conf to drop all logs under /var/log/apple/, including those from any newly created subdirectories? How can I ensure that this rule applies recursively without explicitly listing multiple wildcard patterns? Any guidance would be greatly appreciated! ... View more