I have a similar problem except only some of my Indexes don't show up in the S3 ... View more

Thanks for the suggestion. I actually did a bunch of that but didn't do what I was looking for. I took it up to Reddit and people there led me to this -  https://unix.stackexchange.com/questions/9665/create-tar-archive-of-a-directory-except-for-hidden-files Now it is complaining about the files in the local folder, which makes no sense to me bc I was under the impression those were critical to how the incoming data was being transformed. ... View more

Idk what I'm missing but there no dot under bar files/directories that I can find, so I'm not sure why it's still complaining about it. Super weird. ... View more

Thank you for sticking through this with me. ********* For the [install] section, there's an existing field of install_source_checksum = [SomeString] so I kept that entry and no more section errors. These are the errors I am now getting. Some are OSX related...SMH check_that_splunk_app_package_does_not_contain_files_outside_of_app • A file or folder was found outside of the app directory. Please remove this file or folder: ../._100-it_splunkcloud • A file or folder was found outside of the app within the overall package. OR the file or folder does not have expected permission. Please remove this file or folder OR modify the permission : 100-it_splunkcloud • A file or folder was found outside of the app within the overall package. OR the file or folder does not have expected permission. Please remove this file or folder OR modify the permission : ._100-it_splunkcloud check_that_extracted_splunk_app_does_not_contain_prohibited_directories_or_files • A prohibited file or directory was found in the extracted Splunk App: default/._app.conf • A prohibited file or directory was found in the extracted Splunk App: ../._100-it_splunkcloud ... View more

That makes sense. I do see the app.conf file in the default folder but it doesn't have the sections the error details pointed out. Trying to figure out how to get those pieces back. `Major.Minor.Revision` version is required in `[id]` or `[launcher]` section of app.conf. File: default/app.conf ... View more

I should have been more clear. The "apps" on HF aren't full apps.  I tried uploading a few, it failed the vetting process. The failure report has some good deets on why and now another thing to figure out.   Onboarding Configs linux_app_props script_custom_inputs script_custom_props syslog_props windows_custom_props Deployment Client 10_heavy_forwarders 10_linux Splunk Add-on for Palo-Alto all_WMI all_aruba_props all_git all_syslog_props   ... View more

In learning what the props.conf file does and sampling one of the custom apps, I believe to roughly understand what it is "transforming." Seeing that our Indexers and SHs are on the cloud, how do I get this on there? Do I open a support ticket and upload all the custom apps for them to install? If it's correct, I assume then I can update the UFs and the cloud Indexer (and/or SH) will perform the transform? ... View more

Ok, I believe I understood what you suggested. Vetted our on-prem HFs and discovered 15 custom apps that don't exist on our cloud SH. I haven't gone through their props.conf or transforms.conf files yet, but highly believe they're still in use. Now, I need to figure out how to migrate these apps over...smh ... View more

I'm still green with Splunk, so I apologize for my rudimentary Qs. Many of our apps that exist on the on-prem HFs also exist Cloud Indexers, but for those that don't how do I know if those apps perform transforms? From this thread, I SSH'ed into my HF looking for the props.conf and transforms.conf files and there are many due to the # of installed apps. I cat'ed a few but idk what I'm looking for. * I'm poking around now * ... View more

For step 1, would looking at the app's compatibility to the upgraded version be sufficient? ... View more

Thanks guys. That worked. ... View more

Works. But how do you clean it up where it returns just a single line to show both ports. It's currently showing multiple lines for each different port. ... View more