Here is documentation what happening when you have license violations and when those are real violations and when those are more or less informative messages. https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.3/manage-splunk-licenses/about-license-violations#ariaid-title4 e.g. with Splunk Free there is this limitation: If you generate three or more warnings in a rolling 30-day period, you are in violation of your license. Splunk Enterprise continues to index your data, but you cannot search it. The warnings persist for 14 days. No reset license is available. So after three warnings within 14 calendar days your searches have blocked until there is max two warning in 14 days. But e.g. with Enterprise with more than 100GB/d license you can still search even you have more than 45 breaches within rolling 60 day period. Of course you must contact to Splunk and agree for additional license quota. ... View more

Thank you for this information!! I greatly appreciate it, Ken ... View more

Pass-cert-hub was the perfect resource for my SPLK-2002 preparation. Their practice questions covered every domain—indexing, search optimization, deployment, and troubleshooting. I passed on my first attempt! ... View more

Hi @sureshmani04  hope you got the solution.. if so, could you pls mark the question as solved, so it will be moved from unanswered to solved. thanks. karma / upvotes are always welcomed, thanks.  ... View more

There is a very good writeup about this from Duane here - https://community.splunk.com/t5/Security/Encrypting-indexed-data-on-rest/m-p/40840/highlight/true#M1368 Think about what threats you want to secure yourself from and what access the attacker you're trying to protect from would already have.  If you want to do it just for the sake of compliance and checkbox security, just use an filesystem-level or device-level encryption. But that's nowhere near well-developed controls. ... View more

Hi! Splunk Certifications here. We do monitor this space and would like to remind everyone that Splunk dump websites are illegal representations of Splunk's intellectual property, which our legal team takes quite seriously.  Violation of the Splunk Certification Exam Agreement can result in revocation of certifications and disqualification from any future certification exams. Reach out to certification@splunk.com if you have questions or need more direction for exam preparation. ... View more

Hi @livehybrid  Called the Indian support number, but it looks like a wrong number.  gods must be crazy !    ok, let me wait for Splunk US then. thanks for your suggestion. ... View more

Wait a second. You can't use props/transforms after the events have been indexed. You can do that during indexing after initial ingestion by input. ... View more

You should also check if CM see those peers as member of indexer cluster. Then also check what errors and maybe warnings which told what has happened.  ... View more

@pwoehl Did this worked? Just curious if its resolved and if you found the solution. ... View more

It's been a close to a year now and I still have the same error when trying to use this app on the iPhone what gives????? @splunk Help! ... View more

Hi @mshakeb , please, don't attach your request to another one, even if on the same topic, open a new question. In this way, you'll have more choices to describe your requirements and to receive an answer. ciao. Giuseppe ... View more

I have similar issues poppping up as of late. But how does one isolate the affected forwarder? The error message reads Forwarder Ingestion Latency   Root Cause(s): Indicator 'ingestion_latency_gap_multiplier' exceeded configured value. The observed value is 89. Message from <UUID>:<ip-addrs>:54246 Unhealthy Instances: indexer1 indexer2   The "message from" section just lists the UUID, an IP adress and a port. Which part here would help me find the actual forwarder? The UUID does not match any "Client name" under forwarder management on the deployment server. The IP adress does not match a server on which I have a forwarder installed. One or a few of the indexers are listed as "unhealthy instances" each time. But the actual error sounds like it lives in the forwarder end and not on the indexer. With the available information in this warning/error. How can I figure out which forwarder is either experiencing latency issues OR need to have that log file mentioned flushed. ... View more

@sivaranjiniG  Visit Splunk Education https://education.splunk.com/  and navigate to "My Current Learning" to view all your certifications. If you encounter any issues, refer to the details below and reach out to Splunk for assistance. Official Help/Support: certification@splunk.com Education Education_AMER@splunk.com Education_EMEA@splunk.com Education_APAC@splunk.com Accreditation accreditations@splunk.com   ... View more

Hi @Aedah , you could add this to splunk ideas (ideas.splunk.com) surely many people will be interesd on it. Ciao. Giuseppe ... View more

Hi @SR .. may i know if you get results for the first search.. if no, pls understand that Application= may be service= or something else(depends on your logs).  if your search fails, then pls check the search below: do you get results for index="Nex" Application="Pe***g.Ne**s.Platform.Host" OR the better do this search index="Nex" "Pe***g.Ne**s.Platform.Host" maybe pls send me a direct msg here in my profile, i can try to help you further. thanks.   ... View more

Let me quote myself from earlier: "Just one important thing - if you want to enable TLS, get yourself a CA and issue proper certificates. Using self-signeds everywhere will not help you much securitywise and you'll run into troubles when trying to validate them properly (which might be your case)". If you created self-signed certs for your components, you will have problems validating them. If you have a CA from which you issued those certs, you've probably not configured the root CA's cert as trusted. ... View more

@inventsekar    Sorry for the late reply. My splunk enterprise version is 9.1.0.2.   ... View more

Persistent queue is not for the file monitoring.  ... View more

You're supposed to check the log for this search, not the general logs ingested into _internal. Log for a particular search is - as far as I remember - a part of the artifacts package from the search and gets removed after the search outlives its retention. So search.log is the thing that you get to by clocking at Job -> Inspect Job and there you have the link to see the search.log And in your case it's probably an issue with permissions (you haven't exported the script itself properly from the app - I struggled with it for a long time myself; you can't do it via GUI, exporting lookup definition is not sufficient, you must export the script and allow reading) ... View more

Hi @arunkuriakose  >>> i am trying to visualise this in such a way that i have a live dashboard which shows me which users are passing through which gate  "visualizing" this thru a "live dashboard".... i understand this requirement but it may be difficult to implement.  maybe, reconsider like this: 1. have a basic dashboard with two panels 2. one panel, simple in design, for the gate1, this panel will show you which emp_id crosses this gate1 at what time time   emp_id 9am    1234 9:05am 2383 3. and have another panel for gate2 in the same design logic.  4. auto-refresh this dashboard for every, say 30 sec (increase or decrease this depending on ur requirement) 5. you can have more panels, like missing person (emp_id who entered thru gate1 but not existed thru gate2, etc)   Pls add karma / upvote to any post which helped you in any way, thanks.  ... View more

Hi @inventsekar, thanks for the reply, I just entered one site. On the other hand I would be pleased to share the error logs but none are showing. I configured logging level on the app as "ERROR" and "DEBUG" but no logs appear when I run: index=_internal source="/opt/splunk/var/log/splunk/python.log" level!=INFO Regards, PB ... View more

Fix for me was to rename the expired server.pem certificate file name, restart Splunk which automatically created a new server.pem certificate, then splunk clean kvstore --local , then splunk migrate kvstore-storage-engine --target-engine wiredTiger ... View more

Check permissions. Both in Splunk (the meta entries) an on filesystem. Check if your script runs if you call it with splunk cmd <app_path>/bin/lenlookup.py   ... View more