Hey @N92, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂 ... View more

Hey @splunker969, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂 ... View more

Hey @nagaruju_chittathuru, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂 ... View more

Hey @Naren26, if @niketnilay solved your problem, remember to "√Accept" an answer to award karma points 🙂 ... View more

Hey @kennethyeung, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂 ... View more

Would your TA work for this, @pdoconnell? ... View more

Dear @msg64, Please ensure to use the appropriate buttons when adding answers or comments. The Add Comment field can be found below answers and right below your question. As well, if you submit a post and do not see it immediately, please wait a while before re-posting. At times posts are sent to the moderation queue for review. In this case, multiple attempts were sent to our moderation queue. I went ahead and approved the answer, converted it to a comment, and rejected the other attempts. ... View more

Hey @sancharigupta, can you let us know what version of Splunk you were using and more about your environment? That might help people diagnose further. Thanks! ... View more

Hey @pyde88 - Can you let us know which apps specifically? ... View more

@networkthinking -- re your comment "not able to award points" -- are you able to "Accept" the answer? If not we can file a bug report. Let me know! ... View more

Hey @shiva2007, please remember to post your comments as comments. I just converted this post from an answer. As well, since this post is over one year old it could help to post a new question with your issue. ... View more

Hey @gsypsomos, The buckets don't roll until the last record of each bucket reaches the time specified, so that might be your issue (RE: That setting is supposed to remove anything over 1.25 years old in my data.). As for eliminating the warm bucket and frozen bucket -- you can change your configuration files on those, but I believe the rule of thumb is to definitely use the warm bucket because the search will check the time range on each bucket to see if it should search for results inside of the bucket and can skip the entire bucket if it does not fit that range. This wiki has some more info: https://wiki.splunk.com/Deploy:BucketRotationAndRetention ... View more

Hey @unixmit and @ssievert -- for the universal forwarder ARMv6 you can get it by going to the Linux options of the universal forwarder download page (from the menu at the bottom of the splunk.com website in the footer menu), or by clicking this link: https://www.splunk.com/en_us/download/universal-forwarder.html#tabs/linux I'm not sure what the Splunk Enterprise download is but as @ssievert said please provide the link so we or others can help you. ... View more

Hey @seancruikshankidelta, A product expert might have additional info for you about specific differences, but it looks like the Splunk Insights for AWS Cloud Monitoring is aimed at AWS customers who don't have a Splunk environment already and offers dashboards and solutions 'in a box' that make it really easy to monitor migrations to AWS using Splunk. ... View more

Hey @Moyad63, I'm checking in to see if I can get a typical ETA, but wanted to let you know that you can get started right away with the free Splunk Fundamentals 1 course if you'd like to learn about Splunk while that process is finalized. ... View more

Hey @jincy_18, if @jortonew's response solved your problem, please accept the answer to award karma points and to close the question. Happy Splunking! ... View more

Hey @Sbataccount if @garethatiag answered your question as needed please remember to accept the answer to close the question and to award karma points. 🙂 ... View more

Hi @DUThibault, I poked around and found a few resources to show the partnership between Splunk and Verizon: https://www.splunk.com/en_us/newsroom/press-releases/2016/verizon-and-splunk-join-forces-to-advance-threat-detection-for-enterprises.html Verizon Enterprise Solutions worked w/ Splunk to offer this product in Splunkbase. The app is in beta and Verizon is actively updating and enhancing the tool, and will continue to publish updated version with increased functionality and usability features. http://www.verizonenterprise.com/resources/analyst-reports/ar_frost-and-sullivan-new-product-innovation-award_en_xg.pdf ... View more

Hey @bluestar2017, Is the course still not loading? It usually begins in a separate window. If it isn't working I can reach out and ask the education team if they know about system requirements. Do you know what version browser you're using? And do you happen to have Firefox? That's what I usually run it on. ... View more

Hey @sarge338, welcome to the Splunk community! When you're responding to answers on Answer posts please use the comment feature rather than posting a new "answer". As well, if @sukisen1981 is able to find the solution for you please accept their answer so you can award karma points and close the question! 🙂 You can also upvote to award points. ... View more

Hey @mudragada, I hope you're having fun at .conf! I checked and it looks like the release date is TBD, but I pinged the speaker and will let you know if there's more info in a follow-up comment. ... View more

Hey @mschellhouse, If you have a question, share it with the community, then find a solution, then you should accept your own answer. 🙂 There will be more info as this is edited over time, but you can always reference the Answers documentation as well if you have questions about etiquette. http://docs.splunk.com/Documentation/Community/latest/community/AboutCommunity Happy Splunking! ... View more

Hey @markhvesta, your similar post came through the moderation queue, but please follow this post instead. Additional info from @markhvesta: "The log only references this same generic message, and when setting up the new input, the tables and schema for the new database connection are seen but the error is received before being able to select the input type" ... View more

Hey @frizzoS3, this can be read in docs: Correlation searches can run with a real-time or continuous schedule. • Use a real-time schedule to prioritize current data and performance. Searches with a real-time schedule are skipped if the search cannot be run at the scheduled time. Searches with a real-time schedule do not backfill gaps in data that occur if the search is skipped. • Use a continuous schedule to prioritize data completion, as searches with a continuous schedule are never skipped. As for guided vs. manual mode -- I think this is the difference, "Select a mode of Guided to create a search without having to write the search syntax yourself, or select Manual to write your own search." ... View more

Hi @spmaster, the Splunk Fundamentals course exam covers material from the course itself. All of the topics are available in a list on this course overview page: https://www.splunk.com/view/SP-CAAAPX9 The Splunk Fundamentals 1 course is free and you have 30 days to complete it once you register and begin the course work. It will take at least 15+ hours to complete all of the videos and lab work, or longer if you really want it to sink in. Throughout the course you’ll take quizzes. If you ace these quizzes and review your notes then you’ll finish the Splunk Fundamentals 1 exam without issue. I think I finished it in 25 minutes, but you have about an hour to finish it online and can reference your notes and what not. You take this quiz whenever you’d like to take it through the education portal, so you just need to log in and finish the course materials, then you can take the test any time at all. Access expires after 30 days, which is plenty of time to finish the course and labs if you commit a little time each day or spend a few full days on it. After you finish the Fundamentals 1 exam you can take the certification exam, which is a bit more challenging. For that I recommend reviewing the Documentation notes about each topic in the Splunk Fundamentals 1 course to have a thorough understanding of each topic. You have to email the education team then they’ll send you an email and you can take it on your own time at home whenever you’d like. If you fail the first time you can retake the exam some time later, and if you fail it again then you can take the exam a third and final time. The questions are slightly more challenging, but you’ll be able to finish them within the time limit as long as you have prepared and reviewed these topics. It is open note as well, but you won’t have time to research topics if you have not already studied them, so study, study, study. ... View more