I have a situation with ingestion latency that I am trying to fix. The heavy forwarder is set to Central Standard Time in the front end under preferences. Does the front end setting have any bearing on the props.conf  ... View more

Hi everyone, I've a scenario where Splunk is timing out in querying customer SIEM environments and reporting as potential dropped logs. If I check in the customer's SIEM, I see that there are no dropped logs, so I know the issue is to do with Splunk querying their environment.  Knowing that, I am trying to craft an SPL that looks for searches that were canceled or timed out. Can someone help me with this? What I've tried using is below but it's not accurately correlating to the time stamps I am seeing in the ticket for my customer. Can someone help me build this out more.   index=<customer name> cancelled   ... View more

Hi all, I am new to Splunk and am trying to look for logs that indicate that the SplunkD service shutdown. I am trying this, but I am not sure if there's a better one:         index=_internal sourcetype="splunkd" keywords "*shut"       ... View more