Hi Splunk Community, I recently upgraded my Splunk Universal Forwarders from version 9.4.3 to 10.0, and since the upgrade, I’ve been experiencing issues with the forwarders sending security logs to my Splunk Enterprise instance (which is also running version 10.0). Here are some specific details: Pre-upgrade, everything was working fine, and security logs were being ingested without any issues. After the upgrade, I noticed that security logs are either not getting sent or are being delayed significantly. I've verified that the forwarders are still forwarding some logs, but the security-related ones aren't appearing in the index as expected. The configuration files (inputs.conf, outputs.conf, etc.) on the forwarders haven’t been changed since the upgrade. I’ve tried restarting the forwarders and re-checking the connectivity to the Splunk Enterprise instance, but the issue persists. Has anyone else encountered similar problems after upgrading to 10.0? Could it be an issue with compatibility, or is there something specific I should look into? Any advice or troubleshooting tips would be greatly appreciated! Thanks in advance for your help!
... View more
