I think in 10.4 it's splunk/etc/log-node-platform.cfg Log rotation settings (max file size, backup count, max age, compression) are inherited from the parent sidecar's stanza in log-node-platform.cfg . If no sidecar-specific stanza exists, the [global] stanza is used. If no config exists at all, defaults apply (50MB, 15 backups, 28 days, gz). For <10.4, sorry think it might not be configurable. It's normally the spotlight/spotlight_metrics-2026*.json that goes 2 X 500MB + 1 new. ... View more

Correct link for Splunk Docs - https://help.splunk.com/en/data-management/onboard-data-to-splunk-cloud-platform/other-ways-to-onboard-data/10.5.2605/cisco-source-type-benefit/integrated-enterprise-value-for-cisco-data#ariaid-title1  ... View more

Hi @jcorcoran508 , Looks like you may be running into Known Issue for 9.0.2 on your UF https://docs.splunk.com/Documentation/Splunk/9.0.2/ReleaseNotes/KnownIssues#Universal_forwarder_issues SPL-232467 SSL UF v9.x SSL Cert Auto-populates into Windows Certificate Store Workaround: Make the following changes in server.conf: Before upgrading: Save the original setting of [sslConfig] / serverCert if it's set, and then set the following: [sslConfig] serverCert = C:\Program Files\SplunkUniversalForwarder\etc\auth\new_default.pem [kvstore] disabled = 1 The file `C:\Program Files\SplunkUniversalForwarder\etc\auth\new_default.pem` must not exist before the upgrade. After upgrading: Set serverCert back to the original value and restart the universal forwarder. If it was not set before applying the workaround, it can be left unchanged as the universal forwarder will use the newly generated PEM file. ... View more

I just had customer with similar issue on Windows HF.   First there was the problem of expired cert.  This was not just the  /opt/splunk/etc/auth/server.pem but also the pfx file in same location, And because of the way certs are managed on Windows in Splunk 9.x it was also necessary to delete via  Windows Cert Management in Local / Personal / Certificates...Delete SplunkServerDefaultCert This got us past the expired cert issue... But then we found mongod.log detected Mongo version as "db version v4.2.19".... But then a few lines later complained about.... F CONTROL [initandlisten] ** IMPORTANT: UPGRADE PROBLEM: Found an invalid featureCompatibilityVersion document (ERROR: BadValue: Invalid value for version, found 3.6, expected '4.2' or '4.0'. Contents of featureCompatibilityVersion document in admin.system.version: { _id: "featureCompatibilityVersion", version: "3.6"   So we had to cd to Splunk_Home/var/run/splunk/kvstore_upgrade Renamed versionFile42 to versionFile42.old Run the standalone migration command again... splunk migrate migrate-kvstore Start Splunk, KVStore working! ... View more