Looks good overall. Just fix the port mismatch: FortiGate is configured for TCP 1515, but your tests use 1514/514. Make the test ports match the configured sources, then verify with ss that 1515 and 2514 are listening. ... View more

Your testing already points strongly to the SC4S → HEC hop as the bottleneck. Since direct syslog to Edge is lossless, I’d avoid over-tuning http() and look at bypassing HEC or using a transport with backpressure. The archive test was a great way to prove the loss isn’t happening at SC4S ingestion. ... View more

This usually means the trial license is no longer valid for your instance. Once a trial expires and Splunk falls back to the Free license, you typically can't reapply for another trial manually. Your best option is to request a new evaluation license from Splunk or contact Splunk Support/Sales for a fresh trial entitlement. ... View more

This usually points to a field collision or the lookup replacing values unexpectedly. Verify that User_Login is unique in the database and that no returned fields conflict with existing ones. Running | fieldsummary or comparing the output immediately before and after dbxlookup should reveal where those fields are getting lost. If everything looks correct, it may be worth checking your DB Connect version, as there have been issues with dbxlookup behavior in some releases. ... View more

Check splunkd.log and web_service.log for UI/REST errors, then compare the affected server's config and app versions with the working Deployment Server. Since forwarders are still working, it likely points to a Splunk Web or permissions issue rather than the Deployment Server itself. ... View more

Good catch. The current regex truncates quoted Windows paths at the first space, so supporting quoted strings would make the process extraction much more accurate. This would be a useful enhancement to raise with the maintainers. ... View more

You should check whether the events that fail are being truncated or parsed differently before the transform runs. Even if the regex works, rex, index-time transforms only see the raw event at ingestion, so settings like TRUNCATE, LINE_BREAKER, or INDEXED_EXTRACTIONS can affect the result. Also enable parsing debug logs to confirm whether set_source_from_evt is actually matching those events or being skipped. If the same event sometimes works and sometimes doesn't, that points more toward the ingestion pipeline than the regex itself. If everything looks correct, it may be worth opening a Splunk support case, as inconsistent MetaData:Source transforms during HEC ingestion aren't expected. ... View more

You should contact Splunk Support if this is a production system, but before that I'd recommend checking the mongod.log and splunkd.log files, as they usually reveal why the KV Store failed to start after the upgrade. If the logs point to a corrupted KV Store or an upgrade issue, there are documented recovery steps, but avoid deleting or rebuilding the KV Store until you've confirmed the cause or have a backup. If you can post the relevant startup errors from the logs, the community can help narrow down the fix. ... View more

No, Dashboard Studio doesn't currently support a manual refresh button for all panels while keeping the same filters and relative time range. At the moment, you're limited to auto-refresh or a browser refresh (F5). If this functionality is important, it's worth submitting as a feature request. ... View more