We're running version 6.4.1. It has been 3 days now since we set this up and we are still seeing "Auto-generated but not verified yet". I restarted Splunk on the server just now, still not verified but I'll keep checking it and report if it does successfully verify. This may be related or not, we haven't had any new events come in since we set this up on Tuesday. The troubleshooting page states that we have 1 account and 1 input, neither of which are invalid. ... View more

The best is to exclude the contents of a specific Event ID directly from the Universal Forwarder. Using a Heavy Forwarder for that is not necessary anymore. Create an app to deploy and in the inputs.conf you can create multiple whitelist matching different regex. So you can filter out specific messages or fields within a specific Event ID. whitelist = | key=regex [key=regex] https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf , ... View more

Hi I had a query which used to get the right data before the upgrade. index=_internal source=license_usage.log type=Usage | timechart span=1d sum(b) as bytes | eval GB = round(bytes/1024/1024/1024,5) | fields _time GB It was a single search head then version 6.1 Now its a 3 server cluster and and the current version is 6.3 all the above queries mentioned in this thread does not work either. License Master is still on 6.1 Current architecture : 3 search head, 4 indexers , 2 deployment servers and 100+ universal forwarders. Thanks for looking into this. ... View more