There doesn’t seem to be a way to force auto-refresh to stay enabled after changing the search or time range. For an operations dashboard, I’d check for a kiosk/read-only mode or raise this as a feature request, since persistent auto-refresh would help prevent operators from accidentally missing new alerts. ... View more

The issue is likely with the app handling the refreshed search result, not just the field names. Check whether value is still returned with the same format after the second refresh, and verify App 4537’s compatibility with Splunk Cloud 10.4 and Dashboard Studio auto-refresh. ... View more

You’ll likely need Splunk Support to handle this manually since you can’t access the old email and the free tier blocks the normal support route. Try contacting Splunk through their general account/help channel and explain that you can verify ownership. Keep the old and new email addresses private and only share them with an official Splunk representative. ... View more

Check server.conf rather than log.cfg; Splunk’s log rotation settings are usually defined there. Look for maxFileSize and maxBackupIndex under the relevant logging stanza. Reducing those values should help control the 500 MB files and number of retained copies. ... View more

Squashing can cause large volumes to appear under a blank host, so 100+ GB is possible. Once squashed, it license_usage.log may not preserve the original host details. I’d correlate the spike’s time range with _internal ingestion/metrics data and forwarder activity to identify which hosts are actually generating the volume. ... View more

You should be able to upgrade directly only if Splunk’s 10.4.2 upgrade matrix lists your current versions as supported starting points. I’d check the official upgrade path and RHEL 9.8 compatibility first, especially for the 9.2.2 Heavy Forwarder. Take a backup and test in a non-production environment before upgrading production. ... View more

Check splunkd.log and web_service.log at the time of the export failure. Also verify the search head’s REST services and look for any upgrade/migration errors. The exact log message should point to what’s causing the “Service Unavailable” response. ... View more

Looks good overall. Just fix the port mismatch: FortiGate is configured for TCP 1515, but your tests use 1514/514. Make the test ports match the configured sources, then verify with ss that 1515 and 2514 are listening. ... View more

Your testing already points strongly to the SC4S → HEC hop as the bottleneck. Since direct syslog to Edge is lossless, I’d avoid over-tuning http() and look at bypassing HEC or using a transport with backpressure. The archive test was a great way to prove the loss isn’t happening at SC4S ingestion. ... View more

This usually means the trial license is no longer valid for your instance. Once a trial expires and Splunk falls back to the Free license, you typically can't reapply for another trial manually. Your best option is to request a new evaluation license from Splunk or contact Splunk Support/Sales for a fresh trial entitlement. ... View more

This usually points to a field collision or the lookup replacing values unexpectedly. Verify that User_Login is unique in the database and that no returned fields conflict with existing ones. Running | fieldsummary or comparing the output immediately before and after dbxlookup should reveal where those fields are getting lost. If everything looks correct, it may be worth checking your DB Connect version, as there have been issues with dbxlookup behavior in some releases. ... View more

Check splunkd.log and web_service.log for UI/REST errors, then compare the affected server's config and app versions with the working Deployment Server. Since forwarders are still working, it likely points to a Splunk Web or permissions issue rather than the Deployment Server itself. ... View more

Good catch. The current regex truncates quoted Windows paths at the first space, so supporting quoted strings would make the process extraction much more accurate. This would be a useful enhancement to raise with the maintainers. ... View more

You should check whether the events that fail are being truncated or parsed differently before the transform runs. Even if the regex works, rex, index-time transforms only see the raw event at ingestion, so settings like TRUNCATE, LINE_BREAKER, or INDEXED_EXTRACTIONS can affect the result. Also enable parsing debug logs to confirm whether set_source_from_evt is actually matching those events or being skipped. If the same event sometimes works and sometimes doesn't, that points more toward the ingestion pipeline than the regex itself. If everything looks correct, it may be worth opening a Splunk support case, as inconsistent MetaData:Source transforms during HEC ingestion aren't expected. ... View more

You should contact Splunk Support if this is a production system, but before that I'd recommend checking the mongod.log and splunkd.log files, as they usually reveal why the KV Store failed to start after the upgrade. If the logs point to a corrupted KV Store or an upgrade issue, there are documented recovery steps, but avoid deleting or rebuilding the KV Store until you've confirmed the cause or have a backup. If you can post the relevant startup errors from the logs, the community can help narrow down the fix. ... View more

No, Dashboard Studio doesn't currently support a manual refresh button for all panels while keeping the same filters and relative time range. At the moment, you're limited to auto-refresh or a browser refresh (F5). If this functionality is important, it's worth submitting as a feature request. ... View more