Hi @LovingSplunk  i felt your initial query was bit confusing.  from your line: >>> does anybody have a free license Cribl implementation in conjunction with Splunk, that actually works?  now i feel, your question is: can i use 1 TB Free Cribl and 5TB Splunk together? Yes i think you can use this combination. Thanks.    ---------------------------------------------------------------------------------------------- If this post or any post addressed your question, could you pls: Give it karma to show appreciation PS - As of Apr 2026, my Karma Given is 2290 and my Karma Received is 494, lets revamp the Karma Culture! Thanks and best regards, Sekar ---------------------------------------------------------------------------------------------- ... View more

@LovingSplunk You may first verify the Cluster health status via Monitoring console, ensure RF/SF is met along with checking other indexing panels and then proceed to gracefully take each Indexers offline. Please see reference link for commands. Monitor the bucket fix up activities and give enough intervals in between for Cluster manager to do redistribution of buckets. If you are still seeing the nodes in the CM dashboard, you can remove the peer manually from the manager node's list. Post which you can validate cluster stability using the Monitoring Console dashboards and run sample searches to ensure data is accessible from remaining indexers. Ref: Monitoring: Indexing: Indexer Clustering: Service Activity | Splunk Enterprise (last updated 2026-01-09T19:16:34.696Z) Taking a peer offline: [See permanently section, explained by @richgalloway ]  Take a peer offline | Splunk Enterprise (last updated 2025-07-04T12:42:42.910Z) Remove a peer from Manager node's list:  Remove a peer from the manager node's list | Splunk Enterprise (last updated 2025-07-04T13:04:33.376Z) >> If this post addressed your question, you can: Give it karma to show appreciation 👍 Mark it as the solution if it solved your issue ✔️ Add a comment if you’d like more details ✏️ Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise. >> ... View more

As I always say - you don't _have_ the vulnerabilities, you have reports of vulnerabilities. Has anoyne in your organization bothered to check the vulnerabilities descriptions? And verify if there is any (significant) risk from them? Remember that risk is affected by potential loss as well as exposure and severity. Just because something lights up on Nessus, doesn't mean that it constitutes a noteworthy risk. I'm in no way trying to downplay any specific single vulnerability because I didn't dig throught them to check what they are about but it's about the whole process itself. If your "vulnerability management" consists only of "ok, something in our Nessus report is not green - time to scowl the admin team to make it green again", it's fundamentally broken. Having said that - for all we know, Splunk has a custom agreement with openssl maintenance team and products ship with custom versions of the library. They might or might not have backports of fixes and/or functionality differences vs. stock versions. This also means that deducing the existence of vulnerabilities just by comparing version numbers is very unreliable in this case. And finally - you can't manually do anything with libraries shipped with Splunk products - they are part of the whole package and vulnerabilities (if applicable to the product) will usually be addressed as soon as possible and fixed versions should ship with next Splunk/SOAR/UF release. ... View more

Hi @LovingSplunk  If you want to be able to maintain the version of Postgres in use then you can setup an external Postgres DB using the following guide: https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/7.1.0/run-splunk-soar-on-premises-using-external-services/set-up-an-external-postgresql-server The guide is for 15.3 but I understand later versions should be a similar process. I would not recommend upgrading any library/package (e.g. postgres) bundled inside Splunk SOAR however this might offer the compromise you need if you arent able to wait for the next version of Splunk SOAR (which would usually patch things like this). 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

here is the Splunk official document for upgrading the SOAR https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/7.1.0/upgrade-splunk-soar-on-premises/upgrade-a-splunk-soar-on-premises-instance  ... View more

Hi @LovingSplunk . as @isoutamo said: with 300 IOPS the only way is maintaining your ten IDXs! Otherwise the performces of your system will be too low to support your system. Ciao. Giuseppe ... View more

Those are search heads search bundles which have sent to indexers when query has done. Basically each query send it. Those could be full bundle or delta if there is no need to send all search KO with query. Those files have put on separate directories under this. directory. Subdirectory name told which SH or SHC has sent those.  Basically when there are some old directories which SH's you haven't anymore those are safe to remove. But don't remove anything which is still in use! Basically those should be there in both format xxxxx.delta and xxxxx directory. Delta file is just tar package which are used to transfer those from SH to indexers. At least I didn't know that there is official instructions how to delete those. The safest way to do it is to stop spunk then remove those old directories and files. Then just start splunk. I know that some will use some scripts to remove all than e.g 2-5 latest bundles, but I haven't need to do it by myself. So if you are lack of disk space you could remove those, but with your own risk! If not then just leave and remove those e.g. when you are updating your splunk version or otherwise shut it down. ... View more

To avoid the License Master being configured as a search peer: Check peers: splunk list search-server Remove peer: splunk remove search-server https://<license-master>:8089 Restart Splunk Delete /opt/splunk/var/run/searchpeers/* cache ... View more

Do you mean that you want to check how your specific setup is configured? You have to check your pipelines or whatever they are called in Cribl (I don't remember; I don't use Cribl on a daily basis) and see for yourself. ... View more

That is exactly the solution.  See https://advisory.splunk.com/advisories/SVD-2026-0206   ... View more

Hi there, If you can upgrade Splunk Enterprise to a new version this would be recommended. If you can not upgrade Splunk Enterprise you have to wait for Splunk to release a new "Third-Party Package Updates in Splunk Enterprise".   Hope this helps ... Cheers, MuS ... View more

Just because there not a fix available now does not mean Splunk won't issue a fix. Yes, you can remove the jar file, but do so at your own risk.  At the very least, the file integrity checker will notice the missing file and alert you to it. ... View more