One of my coldbucket indexer lost connection to the SAN and now I have a lot of data and files in my ColdBucket lost+found directory. 1. How can I re-ingest/put these data in their actual folders in the ColdBucket? 2. What can I do with the data in the lost + found directory located in the ColdBucket? ... View more

Can Splunk Enterprise 8.2.6 be upgaded to 9.1.0? ... View more

I'm in a RHEL8, Splunk 8.2.6 distributed environment with single kvstore on each servers. Can Memory Mapped (MMAP) storage engine and WiredTiger storage engine exist in the same Splunk environment but on different servers in single instance? I will like to do the migration but one server at a time over multiple days. ... View more

How/where do I edit/update my Cisco ISE app 2.1.2 to add the index=ise so my app will display data. The ISE is sending data. I can run index=* or index =ise and get data but nothing is populated with the app display.  This is a new install 8.1.1.  Any help is appreciated. Thanks ... View more

How can I forward all my data that are sent to Splunk to a different IP address or device? ... View more

I have reviewed similar questions but haven't found a fix to this. My windows UF is utilizing high memory and processes, causing the servers to become inaccessible. I'm having too many powershell scripts launched, although I have disabled all the PS scripts in the deployed TA_windows . Is there anywhere else in Splunk I need to look for PS Scripts that may be causing this problem? ... View more

Anyone knows if Splunk for Cisco Identity Services is compatible with Splunk Enterprise Version: 8.0.1 or is there another app I could use for the same purpose? Thanks. ... View more

My Cisco Indexer just stopped indexing new data. Splunk is receiving data from the Syslog server but just not getting index and so nothing is showing in the Cisco Networks apps/addon. I do have an input/output file on my syslog servers through UF that is monitoring the folder with the logs, which is not the problem since i can see current&old logs in the SH. The output is pointing to my HF which forwards the data to the Idexer. I'm running 8.0.1 with 1 server each SH, IDX, DP, HF. I know it's not indexing cuz my indexer haven't received data for at least a day and there are no errors in the the logs. ... View more

I'm doing a new install with 8.0.1 and want to install the Splunk App for Unix and Linux that is compatible with ver. 8.0.1. to collect data. I have a HF, SH Idx and Deployment servers. The document doesn't mentioned 8.0 anyone knows if it will work? ... View more

I've my cisco devices sending the logs to kiwi syslog server and writing them to several files, (ise,switches,asa...). I need to monitor and ingest the data. Which servers do I setup the monitoring on? I've 1 search,deployment,indexer,HF each. ... View more

I created a indexes.conf file and placed it in my_all_indexes to keep them in one central location for easy management, which is in the apps folder on the indexer, forwarder, and deployment apps. Now all of my indexes are pointing to the same app. Is that normal, if not how do i change it back.? If i just delete it from these locations all the other apps goes away except the systems ones. How/where do I change them back. My environment 1 search head, 1 deployment server, 1 indexer, 1 Heavy forwarder, etc Name Actions Type App Current Size Max Size ? Event Count Status audit Edit Delete Disable Events my_all_indexes 16 MB 488.28 GB 123K 11 days _internal Edit Delete Disable Events my_all_indexes 1.43 GB 488.28 GB 13.5M 2 months _introspection Edit Delete Disable Events mys_all_indexes 1.38 GB 488.28 GB 1.46M 2 months _metrics Edit Delete Disable Metrics my_all_indexes 571 MB 488.28 GB 6.05M 2 months _telemetry Edit Delete Disable Events my_all_indexes 1 MB 488.28 GB msad Edit Delete Disable Events my_all_indexes 1 MB 488.28 GB 0 asa Edit Delete Disable Events my_all_indexes 1 MB 488.28 GB 0 ios Edit Delete Disable Events myall_indexes 1 MB 488.28 GB 0 ise Edit Delete Disable Events myall_indexes 1 MB 488.28 GB 0 linux Edit Delete Disable Events myall_indexes 1 MB 488.28 GB 0 windows Edit Delete Disable Events myall_indexes 1 MB 488.28 GB 0 main Edit Delete Disable Events my_all_indexes 1 MB 488.28 GB 0 ... View more

Do I need to specify or create each index folder/bucket when doing coldToFrozen at the new location or is it automatically created? ... View more

I'm trying to configure SAML in my Windows Enterprise Environment and keep getting this error: SAML has already been configured, Cannot add a new SAML configuration.saml I can't make any change at all. When I cancelled and come back in, it's says "SAML is not configured" but when I tried configuring SAML I get the error "SAML has already been configured". ... View more

How can I find out what changed in my Splunk Windows environment or how can I compare daily ingested data between days. Up to 4 days ago, my Splunk daily license used was about 50%, now it's down to about 25% almost half of what it has been. My domain environment is still the same, with the the exception of Kiwi Syslog upgrade with the same rules and configurations and logs are been generated and ingested, so unless ... View more