Hi @livehybrid ! Thank for yuou response. Are there subdirectories and files in $SPLUNK_HOME/var/lib/splunk/kvstore/mongo? Look for .wt files (WiredTiger), or collection*, index* files (old mmapv1).   Actually they are: [root@splunk-1 splunk]# ll /opt/splunk/var/lib/splunk/kvstore/mongo | grep wt | wc -l 54  But my question is actually about mongo version. Here it is on Splunk 8.1 [root@splunk-1 splunk]# /opt/splunk/bin/splunk cmd mongod --version db version v3.6.17-linux-splunk-v4   So I want it to upgrade to 4.2 via command /opt/splunk/bin/splunk migrate /opt/splunk/bin/splunk migrate but still no luck and no any error info. ... View more

Thanks! As a mentioned different java versions. And I have the only version currently working - the version I unstalled for java bridge. Dbx.log and jbridge.log shows nothing interesting in debug mode. I cann't afford more time for it and will ask a customer for re-install splunk. ... View more

Uff.... That's the thing I started to do at the begining of my activities. I created TEMP index for test purposes, but then I abandoned it for quicker results.. Hurry is not a good thing. Thanks a lot! ... View more

Sorry for the dalayed answer. The possible reason that were not aware of the log size volume. A single-day Bluecoat log is as big as it is not possible for UF to forward a single-day log file in a short period. It takes about more than 24 hours for UF to forward a single-day log file on the default 256kb/s performance. Unfortunately I have a occasional access to the customers environment to take .confs. But I beleave my suggestion may be quite correct. We don't expect sppedy forwarding for Bluecoat logs appeared too large for the customer's environment and the speed was decreased to the 32k to temporary save the license from violation ... View more