thanks , its effectively the same question though , how to remove the preamble from the autoextractSearch And since this question did not get an answer , thought it better to post Regardless, I opened up a support ticket yesterday (Case 3893384) with Splunk , and if I get a solution , will post reply as an answer Many many thanks for the reply  ... View more

I have an issue with this (index=* OR index=_*) being added to  the Datamodel autoextractSearch It breaks the macro when it references a federated index as "*" does not match to a federated index (in nontransparent mode) (index=* OR index=_*)  AND (index=federated:Indexname)   fails to run while (index=federated:Indexname)    as a constraint works fine is there any way to make the constraint only be driven by the macro OR enable a way of defining the  autoextractSearch to be true ? Many thanks , this would be ever so helpful in building datamodel on enterprise  search heads based on restricted constraints in the splunk cloud  ... View more

This was the work around from Splunk support on the Windows  "UF upgrade" KVstore problem "Hello Jonathan, Thank you for your time on todays call. I have just tested performing the Splunk universal forwarder 8.2.6 to Splunk universal forwarder 9.0.1 upgrade on Windows 2019 Server. I added the following settings to the server.conf [kvstore] disabled = true The upgrade completed with 30 seconds after starting the upgrade process. Please let me know if you have any further questions prior to concluding this case" ... View more

This seems to be a big problem , it affects migration of UFs in our environment 9.0.0.1 -> 9.0.1 and 8.2.6 -> 9.0.1 the sourcetype=splunk_migration, shows that all UF clients suffer a 15minute outage while they wait for the UF to"upgrade the kvstore" ? --- Failed to start mongod. Did not get EOF from mongod after 5 second(s). [App Key Value Store migration] Starting migrate-kvstore. Created version file path=C:\Program Files\SplunkUniversalForwarder\var\run\splunk\kvstore_upgrade\versionFile36 [App Key Value Store migration] Collection data is not available. Starting KV Store storage engine upgrade: Phase 1 (dump) of 2: Failed to migrate to storage engine wiredTiger, reason=Failed to receive response from kvstore error=, service not ready after waiting for timeout=914000ms [App Key Value Store migration] Starting migrate-kvstore. [App Key Value Store migration] Migration is not required. If I get something back from splunk ticket will post here   ... View more

sorry , not an answer , but i  have the same problem with running windows8.1.2 or 8.0.0 on 7.3.X It works on 8.1.X windows UF It is also good on Unix 7.3.6 Search heads (no btool,errors at restart) but lots of stanza errors are introduced , including in other apps if we deploy to windows UF Note we have just decided to migrate from 5.0 to 7.0 for the windows TA until we can complete the 7.3.X UF upgrades If anyone has a soln to it not working I would be glad to hear abut it   ... View more

worked no more messy systemd or messing with sudoers 🙂 ... View more

I see a new release 3.40 https://docs.splunk.com/Documentation/DBX/latest/ReleaseNotes/Releasenotes and in the release notes the following FIX 2020-07-22 DBX-5078 DBXQuery hangs when running 'Execute SQL' Preview so Im hopeful 🙂 ... View more

thanks Again I was really looking for a reference company , but I really appreciate you answering (and will keep asking splunk for a reference otherwise wont be able to role out to the company) Note loaded the Dashboard App(3544) first thing I noticed on the Status dashboard was it wasn't using the same name for identifing a Computer it uses sysmon | stats count by Computer | sort - count While the TA uses ComputerName So doesnot return anything in the search Will see if anyone has reported to github Many thanks again ... View more

Many thanks yes rolled out the Add-on but not the Dashboard mai purpose is to get input into SES, but will investiagte the dashboard Also rolled out along with Splunk_TA_windows , TA-Sysmon-deploy, TA_PWChange and a modified System App to blacklist the metrics.log traffic (thought important) only rolled out to a handfull of systems so far (15), My company was looking for some similar company who had gone through the install, for reference many thanks ... View more