Hello, Planning to Upgrade Splunk Enterprise from version 9.2.1 to latest version 9.4.2 - So can a 9.4.2 latest version Search Head talk to 9.2.1 indexer? or we need to upgrade Indexers as well to same version ? Also Splunk UF 8.0.5 will be able to talk to Indexers ? I read it will be able to talk but only we will not have splunk support for this versions and only we will have P3 support if any issues. Thanks ... View more

Hi Team, Planned to upgrade Splunk Enterprise from Version 9.2.1 to 9.4.2 Latest - Currently my Splunk UF version is 8.0.5. Will 8.0.5 support or i need to upgrade UF version too? Compatibility between forwarders and Splunk Enterprise indexers - Splunk Documentation It says UF 8.0.X will be compatible for 9.4.X (E,M) Events and metrics. Need further clarification on this whether i should upgrade UF or it's ok to be on 8.0.X version. Thanks   ... View more

How to Break a multiple events into a single event based on timestamp? My logs doesn't have a date and it only has timestamp - For Ex - it starts as below format.. 17:22:29.875 Splunk version - 9.2.1 i have tried many options in props.conf but no luck still i could see multiple events in my search and i couldn't see events are breaked as per each timestamp. will LINE_BREAKER works or BREAK_ONLY_BEFORE - tried both but no luck.. is it possible to break events with timestamp in splunk or it's possible to break events only with date and time ?? Thanks in Advance. ... View more

Hello,   I would like send two different index data one to indexer and other to Intermediate forwarder. How the configuration needs to be updated in Universal Forwarder ?  Thanks ... View more

Hello, I have configured an index inside an indexer and when i try to fetch data from that index in search head not getting any data. when i search that same index in indexer i could get the data from the index but not from search head. Could you please assist what configuration needs to be checked on my search head and indexer ? Note - it's not clustered setup.   Thanks   ... View more

Hello , i have a common log file which same name in both production and stage with different name for sourcetype. As i don't want that logs to be ingested from Production i have added below entry in props.conf. [source::<Log file path>] Transforms-null= setnull   transforms.conf [setnull] REGEX = BODY DEST_KEY = queue FORMAT = nullQueue [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue   But i want same log file from stage and not from production - in props.conf adding the sourctype of prod will restrict the logs from production and ingest the logs from stage where sourcetype name is different?? [source::<Log file path>] [sourcetype = <Prod Sourcetype>] Transforms-null= setnull   in Addition - Prod Source Type i have other two logs and i don't want that get stopped because of this configuration changes. Thanks ... View more

Currently I am having a Splunk Indexer with multiple Indexes and a Search Head. I would like to have one or two indexes to be available in two splunk indexer and data should be available to access from Search Head from both Indexer. Thanks ... View more