Hi @sankardevarajan  you can start with following free courses provided by Splunk in STEP 1 Introduction to Splunk IT Service Intelligence 2 Installing and Administering ITSI (eLearning)   also free youtube course by Splunk https://www.youtube.com/watch?v=XAmfolPbO1E  and following two courses are paid    Using Splunk IT Service Intelligence  Implementing Splunk IT Service Intelligence     for certification there is no Prerequisite Certification for this. you can directly attempt the certification  kindly refer to blueprint for exam  https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-itsi-admin.pdf https://www.splunk.com/en_us/pdfs/training/splunk-itsi-certified-admin-track.pdf  ... View more

Hi @Praz_123  you can use rest call in moniotring console for getting inforamtion for SH and Indexers information   | rest splunk_server=<server name> services/server/sysinfo | eval "RAM GB"=round(physicalMemoryMB/1024) | table os_name os_build cpu_arch "RAM GB" numberOfCores numberOfVirtualCores transparent_hugepages.defrag transparent_hugepages.enabled transparent_hugepages.effective_state ulimits* | rename os_name as "Opeating System" os_build as "OS Build" cpu_arch as "OS Arch" numberOfCores as "Physical Cores" numberOfVirtualCores as "Virtual Cores" transparent_hugepages.defrag as "THP Defrag" transparent_hugepages.enabled as "THP enabled" you can use following rest call to run in CLI as well curl -k -u admin:changeme https://localhost:8089/services/server/sysinfo   ... View more

Hi @Jeewan  I can understand your urgecny , I dont think you can get it immedialty. I would suggest to send an email to devinfo@splunk.com. or you might need to request new license.  ... View more

Hi @SN1  telent command need to run on forwader as mentioned by @gcusello and also hope you followed stpes menioned by @livehybrid  ... View more

Hi @Wenjian_Zhu   Indexer acknowledgment will be sent after data written into the disk of indexer.  there is no relation with data replication with indexer acknowledgment acknowledgment is to let forwarders know data has been received at the indexer end and forwarder which sent data to indexer , will remove the events from the wait queue. also recommended to enable   acknowledgment at at intermediate forwader and indexer    ... View more

Hi @mahsa_nvd  Ideally its should not cause any issue for any activitys. if you still want to correct  you can raise ticket to support using  https://splunk.my.site.com/customer/s/need-help/create-case  ... View more

Hi @Nawab  Have you tried integrated using  add on and documention, this documentation helps to setup the iis logs https://docs.splunk.com/Documentation/AddOns/released/MSIIS/About  https://splunkbase.splunk.com/app/3185  ... View more

Hi @dj064  My suggestion would be not use crcSalt setting for log rotation files. Can you please disable it and restart splunk to check status. also if you can share some log files with maksing imp data   crcSalt = <SOURCE> ... View more

hi @Elbald97  In 9.4.0 KV store has been upgarded from 4.2 to 7.x, as this is a major change for KV store as per your deatils upgrade is not working in Indexers. try following link for preupgrade checks for  KV store upgarde  https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/MigrateKVstore#Prerequisites if these are indexers , KV store is not needed on them. you can disable using following on  indexers  server.conf  [kvstore] disabled=true  to aviod kv store upgarde aslong with Splunk 9.4.0 upgarde  kindly set kvstoreUpgradeOnStartupEnabled=false  post splunk upgarde you can upgarde KV store  if these are searchheads then do not disable KV store kindly refer to following documentation for mor details  https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/MigrateKVstore  https://docs.splunk.com/Documentation/Splunk/9.4.0/Installation/AboutupgradingREADTHISFIRST#Key_points_for_upgrading_to_version_9.4  ... View more

Hi @matthewroberson  ES 8.X is not yet available to download for on prem yet. Some cloud customers are in ES 8.0 Hopefully in next couple of weeks it will be available for on prem to download from splunkbase   ... View more

Hi @julienbonastre  thanks for your concern, however some of latest responses for this thread  responses posted work for this query in splunk community  also This question was posted a while ago and might not get the attention you need for your own question to be answered. I suggest you please post a brand new question so your issue can get more visibility. Anyways, I am also giving other posts  urls where it is solved. hope this helps https://community.splunk.com/t5/Splunk-Search/Replacing-quot-No-Results-Found-quot-with-quot-0-quot/m-p/304352   https://community.splunk.com/t5/Splunk-Search/How-can-I-resolve-return-0-for-quot-No-Results-Found-quot/m-p/645819  https://community.splunk.com/t5/Splunk-Search/Display-result-0-rather-than-quot-No-Results-Found-quot/m-p/511204  ... View more

Hi @apietersen  even I am seeing this for first time, howerver I would sugesst to try upgarde to 9.3.1 or 9.3.2  and Under splunk-->var--->log--->splunk  you can find migration log or splunkd.log  for any upagde realated errors  ... View more

Hi @johnnyp74  have you restarted splunk service after updating outputs.conf  and as you mentioned you did ping to check connectivity  however have you did telent on port 9997 to indexer? telnet <indexerip> 9997  in Splunkd.log have you seen any error messages, certainly splunkd.log messages help  to troubleshoot further    ... View more

Hi @smallwonder  Currently there is no option to limit data sent to splunk after reaching certian limit. you can try filter the data which i mentioned earlier post. ... View more

Hi @smallwonder  In addition to @gcusello  said If you want to reduce the data ingested into Splunk like removing some log events you can also try ingest actions. (similar to null queue)  https://docs.splunk.com/Documentation/Splunk/latest/Data/DataIngest#Filter_with_regular_expression This can be done on heavy forwarders, it's an UI based and easy to navigate. Also in case of  monitoring new log files you can try to add ignoreolderthan to avoid ingesting older  specified time. ... View more

Hi @kmahanta_17  1.  First you need to be certified power user  2. for exam preparation        following courses are recommended but not mandatory         Splunk System Administration         Splunk Data Administration          you can refer to documentation for above courses if you are not able to attend courses  https://www.splunk.com/en_us/pdfs/training/splunk-enterprise-certified-admin-track.pdf  Blue Print for exam  https://www.splunk.com/en_us/pdfs/training/splunk-test-blueprint-enterprise-admin.pdf  ... View more

Hi @Glasses2  you can look for skipped searches in moniotoring console  Scheduler Activity: Instance or deployment and bottom of the dashboard you will find panel named  Count of Skipped Reports by Name and Reason ... View more

Hi @ejwade  I’m a Community Moderator in the Splunk Community. you are replying to question was posted couple of  years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question with errors so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

Hi @PeterBoard  Infact recently we faced same issue for domain controller server where UF stopped sending data found that ququs filled up. as per support they asked to change to useACK to False to aviod issue and they said it not recomneded to Use useack= true on UF. in your case any errors your obeserved in splunkd.log during issue  ... View more

Hi @jsbapple  I’m a Community Moderator in the Splunk Community. you are reploying to question was posted couple of  years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

Thanks @PickleRick  for information. I will try use options you menioned as well  ... View more

Hi @tlmayes  seems there is know in issue on latest version for Splunk 9.2 and after. can you follow this link and try fixit  https://docs.splunk.com/Documentation/Splunk/9.3.0/Updating/Upgradepre-9.2deploymentservers Possible issues with upgrade Data not appearing in forwarder management UI following upgrade This problem can occur if your deployment server forwards its data to a standalone indexer or to the peer nodes of an indexer cluster. To rectify, add these settings to outputs.conf on the deployment server: [indexAndForward] index = true selectiveIndexing = true If you add these settings post-upgrade, you might need to restart the deployment server. ... View more

Hi @splunktup1  I would recomend using AWS/AZure/GCP and try creating windows/linux machines and install splunk on them, instead of using VM on Laptop. it might take up lot of resources on laptop. or install splunk directly on laptop  ... View more