I created a small power shell script to collect all Ec2 windows hostnames and Ip addresses. I simulated the existing scripts and locations  already in the system.   I did have success with linux with shell.  No data is returning.   Is there a recipe out there or advice to get results to appear ? ... View more

msiexec.exe /qn /I splunkforwarder-9.0.2-17e00c557dc1-x64-release.msi DEPLOYMENT_SERVER="10.0.0.7:8089" SPLUNKUSERNAME=Admin SPLUNKPASSWORD=S@M3!! AGREETOLICENSE=Yes  LAUNCHSPLUNK=0 This appears to be an upgrade of Splunk. --------------------------------------------------------------------------------) Splunk has detected an older version of Splunk installed on this machine. To finish upgrading to the new version, Splunk's installer will automatically update and alter your current configuration files. Deprecated configuration files will be renamed with a .deprecated extension. You can choose to preview the changes that will be made to your configuration files before proceeding with the migration and upgrade: If you want to migrate and upgrade without previewing the changes that will be made to your existing configuration files, choose 'y'. If you want to see what changes will be made before you proceed with the upgrade, choose 'n'. Perform migration and upgrade without previewing configuration changes? [y/n] y -- Migration information is being logged to 'c:\program files\splunkuniversalforwarder\var\log\splunk\migration.log.2022-12-31.15-42-09' -- Migrating to: VERSION=9.0.2 BUILD=17e00c557dc1 PRODUCT=splunk PLATFORM=Windows-AMD64   It seems that the Splunk default certificates are being used. If certificate validation is turned on using the default certificates (not-recommended), this may result in loss of communication in mixed-version Splunk environments after upgrade. "c:\program files\splunkuniversalforwarder\etc\auth\ca.pem": already a renewed Splunk certificate: skipping renewal "c:\program files\splunkuniversalforwarder\etc\auth\cacert.pem": already a renewed Splunk certificate: skipping renewal Failed to start mongod. Did not get EOF from mongod after 5 second(s). [App Key Value Store migration] Starting migrate-kvstore. Created version file path=c:\program files\splunkuniversalforwarder\var\run\splunk\kvstore_upgrade\versionFile36 [App Key Value Store migration] Collection data is not available. ERROR - Failed opening "c:\program files\splunkuniversalforwarder\va       ... View more

tried a lot of things but no joy - recommendations would be helpful: 9v agent upgrades automation in silent more not workingD msiexec.exe /i splunkforwarder-9.0.2-17e00c557dc1-x64-release.msi DEPLOYMENT_SERVER="10.X.X.67:8089" LAUNCHSPLUNK=1 SPLUNKUSERNAME=Admin SPLUNKPASSWORD=S@v3MY@55!!  AGREETOLICENSE=Yes /quiet   This appears to be an upgrade of Splunk. --------------------------------------------------------------------------------) Splunk has detected an older version of Splunk installed on this machine. To finish upgrading to the new version, Splunk's installer will automatically update and alter your current configuration files. Deprecated configuration files will be renamed with a .deprecated extension. You can choose to preview the changes that will be made to your configuration files before proceeding with the migration and upgrade: If you want to migrate and upgrade without previewing the changes that will be made to your existing configuration files, choose 'y'. If you want to see what changes will be made before you proceed with the upgrade, choose 'n'. Perform migration and upgrade without previewing configuration changes? [y/n] ... View more

I looked around quite a bit and could not find specificly what I am looking for.   I have a user that can create dashboards and reports, however upon creation or existing reports and dashboards he doesn't have the option to change perms like: private to  global or private -app- all apps  what capability in splunk roles have this options ?   ... View more

I have this request to build a report   7am - 1900 Monday-Friday  CST Sat 7am - noon   CST   Splunk is running on UTC - depending on the season the daylight savings 1 hour shift is 6hours or 5hours. what is the best way to compensate the hour shift as the daylight savings time comes and goes yearly ? ... View more

I inherited splunk enterprise installed on ec2 instances.     We have cloud watch sending log data to our splunk -   how do I get that data feed into an index. (not indexers) so confused. ... View more

I am creating an index - configured the inputs.conf file. I have two prod servers with app logs that have the same Linux path  Additionally, I have two test servers (Non-Prod) both had the same linux log paths , but different from the prod servers. Besides hard coding the servers in the inputs.conf file how does the process determine what host to collect the log data from identical paths listed in the inputs.conf some questions: Can I use the same index with prod and non prod (best practice ?) So the inputs.conf has the index=x under the log stanza name  , so that maps the inputs.conf file to collect the data and the data belongs to index=x. In the deployment I create a serverClass with all 4 servers (prod and non prod) and assign the server class to the App that has inputs.conf file.  Should I be creating separate indexes (prod and non-prod) then create separate  Apps (prod and non-prod)  then create separate ServerClasses (prod and non prod) ?   ... View more

New to Splunk cloud and EC2 universal forwarder install -   I am reading that the Cloud Universal Forwarder on Linux needs a credential file ? where is the credential file  location ? Or is it just the same on Splunk on premise Universal Forwarder installs ? The more I research the more I get confused.   ... View more

  Please help - my centos 8 server is show some inactive forwards to my indexer. [splunk@centos8 ~]$ /opt/splunkforwarder/bin/splunk list forward-server Active forwards: 10.0.0.42:9997 Configured but inactive forwards: 10.0.0.36:9997 10.0.0.45:9997 [splunk@centos8 ~]$ outputs.conf [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] disabled = false server = mysplunkindexer1:9997,mysplunkindexer2:9997 ... View more

We have some staging servers in the cloud and are turned down after business hours. Is there any method in With the Deployment server to ignore and not report on the node as being missing ? ... View more

  I have a question on the Dev tutorial as I am unable to figure the behavior or is the output expected under the DESCRIPTION: AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery All the words in “DESCRIPTION” are not delimited a by a white space , is the normal behavior ?   Module 1 of the Splunk>Dev tutorial  https://dev.splunk.com/enterprise/tutorials/module_getstarted/ Set up the sample data bundle To get the Eventgen sample bundle and send it to the devtutorial index, do the following steps: Go to https://github.com/splunk/eventgen/blob/develop/tests/sample_bundle.zip and click Download to download the Eventgen sample data file, sample_bundle.zip, to your computer.       DESCRIPTION AInterpidPanoramaofaMadScientistAndaBoywhomustRedeemBoyinAMonastery     ... View more

I searched around and trying to pin down options on sending Universal Forwarder logs to Splunk Cloud. Diagrams, likes and experiences deeply app preciated. ... View more

I am looking for unstandable Splunk_TA_linux  deployment on a single site instance: 1 deployer 3 clustered search heads 1 Cluster Master 3 clustered indexes 1 deployment server   I searched and could not find install guide for this add on - I have found some but not deep enough to prevent a messy end.      Help would be greatly appreciated.   ... View more

Greetings:   In search of Cisco sampling logs with the sourctype=cisco_wsa_squid to  sharpen my spl . Can any one point me to a location of such log for download ? ... View more

Greetings-  We clone a working group in LDAP and expecting the cloned group to show in Splunk Ldap page with the new Ldap group name. LDap windows team has indicated that the cloned group looks all good. Is there a configuration to set so I can see the newly cloned LDAP group ?   ... View more

I have been trying for 2 days to  get the proper syntax for get the UF agent version along with the RHEL os_release  to be displayed as a report. I can get each separately but not together .... Can anyone help ? ... View more