We have Splunk Enterprise installed in almost 6 different regions(APAC/AUS/LATAM/EMEA/NA/LA) worldwide and now we are looking for feasibility check for implementing :- a. Single Triage Dashboard which can be deployed in one region and can be accessing data coming from all these 6 regions. b. I understand that looking at the current setup we can't access Splunk data from one region to other region. However, is there a possibility through API calls or any other method that we can access other region Splunk data? Kindly assist us on this topic if anybody can help. ... View more

Hello, We are in process of upgrading our Splunk Infrastructure from ver 7.x to 8.x. Before migration, we are stuck in the functionality testing of Alert manager ver 3.08 on Splunk Enterprise 8.1.4 (Dev env). We are seeing that the alerts which gets triggered with Alert Manager ver 3.08, are not getting converted from "New" status to "auto_assigned".  We have checked the configurations and logs, we couldn't find anything which can give us the clarity on this issue. Kindly help us in this issue, if you can provide alternate way to find out the root cause of this.   Note: I am attaching logs from  the Dev environment where there is no log entry of  "Set status of incident <id> to auto_assigned".     ... View more

Hello, I am looking for a help here, this is a very weird issue that I am facing. I have a requirement to monitor Event ID 4624 and 4625 from a specific set (10) of servers. I have used following inputs.conf, but instead of receiving these specific events data, i am receiving some other event codes such 4670, 4719, 4742, 4738 etc. I have tried almost all possible ways, but unable to understand what's really happening here. [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 # only index events with these event IDs. whitelist = 4624, 4625 index = wineventlog sourcetype = xyz renderXml=false ... View more

We are looking for 32-bit version of Splunk UF agent for Debian OS, which we did not find  in the Splunk portal. Is there any binary for the same or if there is any way we can monitor 32-bit Debian OS performance counters? Please suggest or provide the link to download binaries. ... View more

I am trying to connect to few of the MSSQL DB instances wherein the Force Encryption is enabled (set to true) and if I try to create DB connection through Splunk DB Connect Version: 20.02.3.0 Build 1, it gives me error as *"I/O Error: DB server closed connection."* While checking this issue on Splunk Answers portal, I have gone through similar question with title *"Splunk DB Connect 2: Why am I unable to connect to MSSQL with encryption?"*. But even though I set the connection parameters same as mentioned in that link, it doesn't work. After following this, I am getting error as *"This driver is not configured for integrated authentication. ClientConnectionId:bc701e78-0062-4bb6-af77-7b6d4238a340"* Here is the DB Connection input which I am using:- [DB_Connection] connection_type = generic_mssql_with_windows_auth jdbcURLFormat= jdbc:sqlserver://:/;useCursors=true;domain=;integratedSecurity=true;encrypt=true;trustServerCertificate=true disabled = 0 identity = localTimezoneConversionEnabled = false port = 1600 readonly = true database = master host = abc.com Please can someone assist me on this, as I am not able to find any other option to establish connection to the encrypted DB instances. ... View more