Your goal is best matched by blockOnCloning=false on both groups. This allows events to continue flowing to an available group even when the other is down, but once the unavailable group’s queue fills, events destined for it can be dropped. So it’s a trade-off: better availability, but no guarantee of delivery to the failed group. ... View more

Use strptime() to combine the lookup’s date/time fields, then compare them with $time_tkn.earliest$ and $time_tkn.latest$. Filter by workplace="$dropdown1_tkn$" and return the matching orderId values. ... View more

You can use a scripted input or HEC to pull Informatica IDMC data through its REST APIs and send it into Splunk. If there’s no native add-on, a small custom integration is usually the simplest approach. ... View more

Seeing the same issue here. Since it affects all apps and the REST call returns 500, it looks more like a SaaS-side service problem than app data. I’d check AppDynamics status/support for an incident while waiting for a fix. ... View more

You should be able to upgrade directly from 9.3.1 and 9.2.2 to 10.4.2; no intermediate version is typically required. Still, run the Splunk upgrade readiness checks and confirm your apps/add-ons and RHEL 9.8 are supported before proceeding. Take a backup and test the upgrade on a non-production instance first. ... View more

Same issue here. Data is ingesting, but saving the domain just sends me back to the same setup screen. Seems like the domain selection isn’t being saved. ... View more

Start with search.log and the Job Inspector, then check indexer health, CPU/memory, disk space, and search peer connectivity. If it only affects certain indexes, focus on the indexers hosting those indexes. Intermittent partial results often point to a resource or connectivity issue. ... View more

Yes, Splunk Observability Cloud supports scheduled dashboard reports by email. Check the dashboard’s reporting options to configure a weekly schedule and recipients. ... View more

Yes, that's correct. The UF initiates the outbound connection to the Deployment Server on TCP 8089. The Deployment Server does not initiate connections back to the UF. ... View more

If both services are running, check whether Splunk Web can reach the 8089 management port. Review splunkd.log and web_service.log for errors, verify web.conf/server.conf, and make sure no firewall or proxy is blocking the connection._ ... View more

Your regex looks close, but the Message field may not match the exact path format.  Before and after the path, and verify the raw event to confirm how Message is stored. Testing the regex against the raw event usually reveals the mismatch. ... View more

Good points. I'd especially recommend testing /raw with multiline events before relying on it, as behavior across separate requests can be tricky. The note about /event only parsing timestamps when explicitly requested is also an important distinction. ... View more