For general guidelines, see https://help.splunk.com/en/splunk-enterprise/get-started/deployment-capacity-manual/10.4/performance-reference/reference-hardware#indexer-0 SSDs are highly recommended This Splunk Lantern article compares ext4 and XFS file systems.  It concludes ext4 is faster.   ... View more

We could use more information.  What version did you upgrade from?  What version is the Agent Manager  (AM) running?  Are the UFs phoning home (to the AM)? ... View more

Configtracker is not enabled in Splunk Cloud. You may be able to get the information you seek from the audit logs.  See https://help.splunk.com/en/splunk-cloud-platform/administer/manage-users-and-security/10.6/audit-activity-in-the-splunk-platform/tracking-configuration-changes-with-audit-logs#ariaid-title3 ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

I've never seen an official document that has all of that information in one place.  Such a document would be hard to produce since it involves third-party apps.  Each app you install and each threat intelligence service you use will require a different hole in the firewall.  The documentation for each should provide the necessary information. At the very least, you should allow *.splunk.com to grant access to splunkbase and for license use reporting. ... View more

Please tell us about the problem you are trying to solve.  What log changes do you want to track?  Splunk already automatically indexes new log entries, but are there other changes you want to know about? ... View more

The only documentation for this app appears to be the Details, Installation, and Troubleshooting tabs on its splunkbase page (https://splunkbase.splunk.com/app/8308). ... View more

We're just members of the Splunk Community and don't have access to your account.  You can try contacting Splunk Support. I removed your email address from the message. ... View more

There are a few ways to onboard data into Splunk. Install a universal forwarder on the server to send log files to Splunk.  This probably won't work in your case. Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog Use the server's API to extract data for indexing Use Splunk DB Connect to pull data from the server's SQL database. Have the application send data directly to Splunk using HTTP Event Collector (HEC). ... View more

I just downloaded with no problems.  Try the usual web fixes: clear cache and cookies, try a different browser, or use incognito mode.  You might also try copying the wget link into your CLI. ... View more

Please share the full props.conf stanza for the sourcetype and the referenced transforms.conf stanzas. ... View more

Splunk Enterprise NOT provide native encryption at rest for indexed data stored locally.  There is no documentation of that just as there is no documentation for the many other features Splunk does not provide. Splunk does not offer a recommended means for at-rest encryption.  That's up to each customer based on their requirements and capabilities. ... View more

Since version 9.x, universal forwarders install with the management port disabled by default.  Override that by setting the mgmtHostPort attribute in web.conf.  See the Admin manual for details. ... View more

Here are some things to try. Verify the CM is still running. Verify the CM is a search peer of the MC. Confirm there are no pending changes waiting to be applied in the MC. Confirm the MC is still allowed to connect to the CM (new firewall rule, perhaps). Check the MC's logs to see if reports any messages when trying to contact the CM. Restart the Splunk instance running the CM. Restart the Splunk instance running the MC. If you still can't figure it out, post a reply with more detail. ... View more

The first thing to do is have the Cluster Manager remove all excess buckets.  That leaves you with fewer to examine/back up. You may have noticed that some bucket names begin with "db_" and some begin with "rb_".  The former designates a primary bucket and the latter is for replica buckets.  So you might think you can just back up the db_* files and avoid duplicates.  Yes, you can, HOWEVER, if a primary bucket is lost one of the replicas will be made the new primary without changing the name.  That means skipping the rb_* files could keep a primary bucket from being backed up.   The likelihood of that happening depends on how often you back up the cluster and how often an indexer fails. To find the true primary buckets, ask the CM using this REST API call | rest /services/cluster/master/buckets search=has_primary=true Then use the output to drive the backups. ... View more

Splunk has a manual describing how to upgrade the Windows Universal Forwarder (UF).  See https://help.splunk.com/en/splunk-enterprise/forward-and-process-data/universal-forwarder-manual/9.4/upgrade-or-uninstall-the-universal-forwarder/upgrade-the-universal-forwarder ... View more

To get unsupported version of Splunk for interim upgrade steps, contact Splunk Support.  They can get it for you. ... View more

The Splunk Cloud service does not allow sending data outbound.  One can send alerts, reports, published dashboards, etc., but not raw events. ... View more

Deleting instance.cfg will not help with connectivity issues.  It will force the UF to generate a new GUID for itself and make it appear as a new UF to the DS.  The old GUID will show up as a "missing forwarder" in the Monitoring Console. ... View more

Linking an Azure-based database to Splunk is not much different from linking any other SQL database to Splunk.  This old answer should still be relevant.  If you still have problems getting it to work, reply with specific questions. ... View more

Submit a support request and ask for a Forwarder license. ... View more

1. A monitor input will do this.  Monitor a directory and the UF will detect new files in that directory.  Add ... to the path and it will detect new subdirectories where the ... is. 2. A monitor input will do this, too.  Monitor a file and the UF will detect when data is added to the file.  Note that Splunk is designed to read new text added to the end of a file.  Changes in the middle will likely go undetected. 3. Nothing in Splunk will do that.  A workaround is to run a modular input (Python or Java program) that monitors the desired file(s) and then converts them when updates are detected. ... View more

This probably should go in the Enterprise Security channel, but it looks like the drilldown search is using token $Host$, which doesn't exist.  Try $host$. ... View more