You should be able to upgrade directly from 9.3.1 and 9.2.2 to 10.4.2; no intermediate version is typically required. Still, run the Splunk upgrade readiness checks and confirm your apps/add-ons and RHEL 9.8 are supported before proceeding. Take a backup and test the upgrade on a non-production instance first. ... View more

Same issue here. Data is ingesting, but saving the domain just sends me back to the same setup screen. Seems like the domain selection isn’t being saved. ... View more

Start with search.log and the Job Inspector, then check indexer health, CPU/memory, disk space, and search peer connectivity. If it only affects certain indexes, focus on the indexers hosting those indexes. Intermittent partial results often point to a resource or connectivity issue. ... View more

Yes, Splunk Observability Cloud supports scheduled dashboard reports by email. Check the dashboard’s reporting options to configure a weekly schedule and recipients. ... View more

Yes, that's correct. The UF initiates the outbound connection to the Deployment Server on TCP 8089. The Deployment Server does not initiate connections back to the UF. ... View more

If both services are running, check whether Splunk Web can reach the 8089 management port. Review splunkd.log and web_service.log for errors, verify web.conf/server.conf, and make sure no firewall or proxy is blocking the connection._ ... View more

Your regex looks close, but the Message field may not match the exact path format.  Before and after the path, and verify the raw event to confirm how Message is stored. Testing the regex against the raw event usually reveals the mismatch. ... View more

Good points. I'd especially recommend testing /raw with multiline events before relying on it, as behavior across separate requests can be tricky. The note about /event only parsing timestamps when explicitly requested is also an important distinction. ... View more