With splunk Stopped please give me the output of netstat -aon|grep 8089 if this shows 8089 is established connection then you will need to disconnect what ever it is and start splunk with splunk user again shoudl fix the issue. ... View more

Use this script I have added below: open powershell ISE or powershell as administrator: ----------------------------- The path C:\splunk_install needs to be created and put msi and other files in it  open Powershell ISE as admin and then run the script make sure the msi name is correct as per the msi you have up to versioning etc. it should be exact name. this works fine for most of people has been tested. ------------------------------- $srcAppPath = "C:\splunk_install\Splunk_TA_windows" $appPath = "C:\Program Files\SplunkUniversalForwarder\etc\apps" #installing forwarder Invoke-Command -ScriptBlock { & cmd /c msiexec /i "C:\splunk_install\plunkforwarder-9.1.2-b6b9c8185839-x64-release.msi" AGREETOLICENSE=Yes /quiet} Write-Host "Installation complete on $file" -ForegroundColor Green Write-Host "Validating install by checking if service is running." Get-Service -Name "SplunkForwarder" -ErrorAction SilentlyContinue Write-Host "SplunkForwarder service is Running on $file" -ForegroundColor Green Write-host "Copying necessary files for splunk ..." write-host "stopping splunk service" -ForegroundColor Green Stop-Service -Name SplunkForwarder #copying addons write-host "copying $srcAppPath" Copy-Item -Recurse -Path $srcAppPath -Destination $appPath -Force write-host "copy $srcAppPath complete" write-host "copying $opappsrc" Copy-Item -Recurse -Path $opappsrc -Destination $appPath -Force write-host "copy $opappsrc conmplete" Start-Service -Name SplunkForwarder Write-Host "Validating by checking if service is running." Get-Service -Name "SplunkForwarder" -ComputerName $file -ErrorAction SilentlyContinue Write-Host "SplunkForwarder service is Running on $file" -ForegroundColor Green write-host "Complete" ... View more

msiexec /i "splunkforwarder-9.1.2-xxx-x64-release.msi" AGREETOLICENSE=Yes /quiet  add complete location of msi and deployementclient.conf in script. ... View more

[+\-0-9#$%^!._?@]  character class  ... View more

there is no easy way of doing it but check the macros an app uses and then in that macro normally there is  a search which points to an index. settings-->advanced search-->search macros and there you can find the index being used by app. ... View more

and for Ubuntu when you try to start it manually does it start or gives the same errors? ... View more

for windows the service status should be set to automatic for it to start on boot. ... View more

or you are getting any permissions issue on splunk. ... View more

Did you try btool to check your configs, indexes.conf , inputs etc. may be there is a overlapping setting routing data somewhere else. ... View more

why are you trying to forward from indexing layer and not from forwarding layer directly. setup the outputs in HF or SF to send data to qradar and splunk instead of from indexers. Ideally I would do that. ... View more

I would recommend uninstall and reinstall using the link I sent. ... View more

I am not sure what your architecture is but use .rpm its use command line installation.  you have all the steps listed here.  https://docs.splunk.com/Documentation/Forwarder/9.0.4/Forwarder/Installanixuniversalforwarder  ... View more

if its a normal linux server use  https://www.splunk.com/en_us/download/universal-forwarder.html?locale=en_us else if this splunk cloud instance then check the article below- https://docs.splunk.com/Documentation/Forwarder/9.0.4/Forwarder/ConfigSCUFCredentials  ... View more

I think you need to configure and accelerate the relevant datamodels in splunk for that. Settings-->datamodels. https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutdatamodels  look at this as well. ... View more

You should be able to club them in to a app and then export that app with all dashboards. else you will have to check which app the dashboards are in and then export them from backend. ... View more

Quantum,  It will be great if you can accept one of the replies as answer. ... View more

Data retention can also be checked from indexes.conf thuogh you will have to convert time. ... View more

I have not found any problems with v9 at all and i have o365 data integration. so cant comment on that you need to check logs. if still cant find anything open a case with support. ... View more

The cert will not be in app. it is always under $SPLUNK_HOME/etc/auth and you point the app in that direction check your cert  check the cert with this : $SPLUNK_HOME/bin/splunk cmd openssl x509 -enddate -noout -in file.cer make sure your $SPLUNK_HOME is set correctly or just set the path replacing $SPLUNK_HOME ... View more

check the cert with this : $SPLUNK_HOME/bin/splunk cmd openssl x509 -enddate -noout -in file.cer make sure your $SPLUNK_HOME is set correctly or just set the path replacing $SPLUNK_HOME ... View more

As i was saying check if the inputs have the correct path to cert and error is very specific  "verify failed: self signed certificate in certificate chain" inputs are detecting a self signed cert instead of CA one. ... View more

if its a CA signed cert then are your o365 inputs still using the same cert. The path in inputs where it requests for ssl info is that correct? ... View more

What type of cert is it ?internal  CA signed or splunk self signed ones? ... View more

if you were using a ssl certificate then check it is still there like validity etc. and make sure it is still owned by splunk user ... View more