I can rule out both, as other manipulations work. However, I was happy to carry out your test with the following result: { "vzl": 0, "ts": 1770063182265, "q": 0, "user": "system.user.zdmin" } ... View more

Thanks for your suggestion. I've already tried egex101, but the one that was successfully tested... /, "q": 0, "user": "system.user.admin"/g ...doesn't work either. ... View more

Thank you for your support... but unfortunately, this suggestion does not work, and the entire log continues to be indexed... ... View more

root@debian:~# /opt/splunk/bin/mongod --version /opt/splunk/bin/mongod: error while loading shared libraries: libsasl2.so.3: cannot open shared object file: No such file or directory ... View more

splunk@debian:~$ tail -n50 /opt/splunk/var/log/splunk/mongod.log mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libssl.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libssl.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libssl.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libssl.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libssl.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libcrypto.so.10: no version information available (required by mongod) mongod: /opt/splunk/lib/libssl.so.10: no version information available (required by mongod) In my case, the problem exists since some kernel updates like debian 12.11 and debian 13.0... https://lists.debian.org/debian-testing/2025/07/msg00035.html link-systemctl-shared=true/false ... View more

In the Splunk UI appears an error... KV Store process terminated abnormally (exit code 4, status PID 55313 killed by signal 4: Illegal instruction). See mongod.log and splunkd.log for details. KV Store changed status to failed. KVStore process terminated.. Failed to start KV Store process. See mongod.log and splunkd.log for details. ... View more