log10x-mcp 1.30.21 → 1.30.23

package/build/product-kb/docs/apps/receiver/compact/splunk.md

@@ -1,12 +1,12 @@
 ---
-title: "10x app for Splunk"
+title: "Log10x App for Splunk"
 description: "Splunk app for transparent expansion of 10x-optimized events"
 source: "https://github.com/log-10x/splunk-app"
 icon: "material/greater-than"
 
 ---
 
-Search and visualize [compact](https://doc.log10x.com/run/transform/#compact) events in Splunk; the original lines expand back exactly at search time. This [open-source app](https://github.com/log-10x/splunk-app){target="_blank"} expands compact events at search time: classic dashboards keep their panels unchanged, the search bar wraps a query in one command, and scheduled alerts compile once at save time so the scheduler runs them natively.
+Search and visualize [compact](https://doc.log10x.com/run/transform/#compact) events in Splunk; the original lines expand back exactly at search time. This [open-source app](https://github.com/log-10x/splunk-app){target="_blank"} expands compact events at search time: classic dashboards keep their panels unchanged, the search bar wraps a query in one command, and an alert created in the app's Compile Alert view compiles once so the scheduler runs it natively.
 
 Use the [Reporter](https://doc.log10x.com/apps/reporter/) (DaemonSet, pre-ingestion) or the [MCP server](https://github.com/log-10x/log10x-mcp){target="_blank"}'s SIEM-sample tool (agentless, via Splunk REST API) to identify optimization opportunities in your existing Splunk data.
 
@@ -18,22 +18,22 @@ Use the [Reporter](https://doc.log10x.com/apps/reporter/) (DaemonSet, pre-ingest
 
 ## :material-chart-line: Analytics Dashboard
 
-The app includes a built-in analytics dashboard providing real-time visibility into optimization performance, storage savings, and ROI metrics.
+The Analytics dashboard shows compact event counts, active templates, compression ratio and storage saved. It finds compact events through the `tenx-events` macro.
 
 <figure markdown="span">
-  ![10x Analytics Dashboard](../../../assets/splunk-app.png){ loading=lazy }
-  <figcaption>10x Analytics Dashboard showing encoding metrics and ROI</figcaption>
+  ![Analytics dashboard](../../../assets/splunk-app.png){ loading=lazy }
+  <figcaption>The Analytics dashboard</figcaption>
 </figure>
 
-| Metric | Description |
+| Panel | Description |
 |--------|-------------|
-| **Total Encoded Events** | Count of optimized events ingested |
-| **Active Templates** | Number of unique patterns in KV Store |
-| **Reduction Ratio** | Average reduction factor across all events |
-| **Storage Savings** | Estimated bytes saved and percentage reduction |
-| **Event Volume Over Time** | Trend comparison of encoded vs original volume |
-| **Top Templates by Usage** | Most frequently matched patterns |
-| **Expansion Success Rate** | Percentage of events successfully expanded |
+| **Total Encoded Events** | Compact events indexed |
+| **Active Templates** | Templates in the KV Store |
+| **Compression Ratio** | Original size over compact size, on the latest 5,000 events |
+| **Estimated Storage Savings** | Bytes saved and percentage reduction, on the latest 10,000 events |
+| **Event Volume, Last 7 Days** | Compact events per hour |
+| **Top 10 Templates by Usage** | Template hashes with the most events |
+| **Inflation Success Rate** | Share of the latest 1,000 events that expand |
 
 ---
 
@@ -41,13 +41,13 @@ The app includes a built-in analytics dashboard providing real-time visibility i
 
 A [compact event](https://doc.log10x.com/run/transform/#compact) carries a template hash and the event's variable values. The constant words live in the KV Store, so the app puts them back at search time and re-applies the search to the expanded lines.
 
-Classic dashboards are rewritten in the browser and keep their panels unchanged. Splunk's search page loads no app JavaScript, so a query typed there is wrapped in the `tenxsearch` command, which runs the same rewrite server-side. Scheduled alerts compile once at save time and then run as ordinary saved searches.
+Classic dashboards keep their panels unchanged: the browser sends each panel's search to the app, which rewrites it on the server. Splunk's search page loads no app JavaScript, so a query typed there is wrapped in the `tenxsearch` command, which runs the same rewrite. An alert created in the **Compile Alert** view compiles once and then runs as an ordinary saved search.
 
 Compact mode encodes the entire event for Splunk, including the Kubernetes metadata, into a single compact line. Splunk bills against uncompressed ingest volume, so compacting everything maximizes license-cost reduction. The Receiver uses a different mode for Elasticsearch from the same forwarder pipeline; there, only the log message is encoded so plugin queries on metadata still work. The [splunk-app README](https://github.com/log-10x/splunk-app#receiver-side-configuration){target="_blank"} covers the Receiver setting.
 
 ### :material-arrow-right-bold-outline: Ingestion Flow
 
-Events are [compact](https://doc.log10x.com/run/transform/#compact) at the edge and ingested into Splunk with reduced payload size:
+The Receiver [compacts](https://doc.log10x.com/run/transform/#compact) events at the edge, and Splunk ingests them into Splunk with reduced payload size:
 
 <div style="text-align: center;">
 
@@ -111,7 +111,7 @@ graph LR
 
 📊 **Results**: fully expanded events, with the original search re-applied so only true matches remain
 
-**Scheduled alerts** run server-side, where the browser hook never fires. They are instead compiled once at save time into a native saved search (a template-hash prefilter plus the [`tenx-inflate`](https://github.com/log-10x/splunk-app) macro), so the scheduler runs an ordinary search with no per-run proxy. The **10x Compile Alert** view and the `/tenx-alert` endpoint handle this, and a recompile pass migrates legacy alerts to native form and refreshes their prefilters as new templates appear. See [SAVE_TIME_ALERTS.md](https://github.com/log-10x/splunk-app/blob/main/SAVE_TIME_ALERTS.md){target="_blank"}.
+**Scheduled alerts** run server-side, where the browser hook never fires. An alert created in the **Compile Alert** view, or through the `/tenx-alert` endpoint, is compiled once at save time into a native saved search (a template-hash prefilter plus the [`tenx-inflate`](https://github.com/log-10x/splunk-app) macro), so the scheduler runs an ordinary search with no per-run proxy. The **Compile Alert** view and the `/tenx-alert` endpoint handle this, and a recompile pass converts `| tenxsearch` alerts to native form and refreshes their prefilters as new templates appear. See [SAVE_TIME_ALERTS.md](https://github.com/log-10x/splunk-app/blob/main/SAVE_TIME_ALERTS.md){target="_blank"}.
 
 ---
 
@@ -133,7 +133,7 @@ Get encoded events flowing to Splunk in under 15 minutes.
 
     | Requirement | Description |
     |-------------|-------------|
-    | Splunk Enterprise | Version 8.x, 9.x, or 10.x (bundled Python 3.7 through 3.13) |
+    | Splunk Enterprise | 9.4 through 10.4 (bundled Python 3.9 through 3.13) |
     | Admin Access | Required for app installation and KV Store setup |
 
     ??? tenx-checklist "Verify Installation"
@@ -141,12 +141,12 @@ Get encoded events flowing to Splunk in under 15 minutes.
         After restart, confirm the app appears in Splunk:
 
         1. Navigate to **Apps** → **Manage Apps**
-        2. Search for "10x" - you should see **10x for Splunk**
+        2. Search for "10x"; the list shows **Log10x App**
         3. Click the app name to open the Analytics dashboard
 
 ??? tenx-step-config "Step 2: Create HEC Tokens"
 
-    Create two HTTP Event Collector tokens in Splunk - one for templates, one for encoded events.
+    Create two HTTP Event Collector tokens in Splunk: one for templates, one for encoded events.
 
     **Navigate to HEC Settings:**
 
@@ -168,15 +168,35 @@ Get encoded events flowing to Splunk in under 15 minutes.
     | Setting | Value |
     |---------|-------|
     | Name | `tenx-encoded` |
-    | Source type | Select appropriate for your logs |
+    | Source type | `tenx_encoded` |
     | Index | Your target index |
     | Enable indexer acknowledgement | Off |
 
+    The app recognizes compact events by their sourcetype. To use a sourcetype other than `tenx_encoded`, add the app's extraction to that sourcetype's `props.conf` stanza:
+
+    ```ini title="props.conf"
+    [my_sourcetype]
+    REPORT-tenx = tenx-hash-vars-extraction
+    ```
+
+    !!! tip "Point the dashboards at these events"
+        The app's Analytics and Diagnostics dashboards find compact events through the `tenx-events` search macro, which defaults to `index=* sourcetype=tenx_encoded`. Set it to your index and sourcetype under **Settings** → **Advanced search** → **Search macros**, for example `index=my_compact_index sourcetype=tenx_encoded`.
+
     !!! warning "Create Index First"
         If `tenx_dml` index doesn't exist, create it via **Settings** → **Indexes** → **New Index** before creating the token.
 
 ??? tenx-step-link "Step 3: Configure Forwarder"
 
+    Set three options in the Receiver's configuration. Each keeps expansion exact:
+
+    | Option | Value | Why |
+    |--------|-------|-----|
+    | `varMaxRecurIndexes` | `0` | Every variable value travels in the event |
+    | `timestampZone` | `UTC` | The app renders timestamps in UTC |
+    | `maxPerObject` | `1` | The app stores one timestamp format per template |
+
+    A template that breaks the first or third rule stays compact and carries `tenx_expand_refused`, naming the reason.
+
     Configure your log forwarder to send encoded events and templates to Splunk.
 
     === ":simple-fluentbit: Fluent-bit"
@@ -203,7 +223,7 @@ Get encoded events flowing to Splunk in under 15 minutes.
             event_source      fluent-bit-tenx
             event_sourcetype  tenx_dml_raw_json
             TLS               On
-            TLS.Verify        Off
+            TLS.Verify        On
 
         # ========================= ENCODED EVENTS OUTPUT ====================
         # Routes encoded log events to your target index
@@ -215,14 +235,14 @@ Get encoded events flowing to Splunk in under 15 minutes.
             Port              8088
             Splunk_Token      YOUR_ENCODED_EVENTS_HEC_TOKEN
             event_index       your_logs_index
-            event_sourcetype  your_sourcetype
+            event_sourcetype  tenx_encoded
             event_key         $log
             TLS               On
-            TLS.Verify        Off
+            TLS.Verify        On
         ```
 
         !!! danger "Critical: event_key $log"
-            Without `event_key $log`, Fluent Bit wraps events in JSON: `{"log":"~hash,var1,var2..."}`. The Splunk app cannot expand this format. Always use `event_key $log` for encoded events output.
+            Without `event_key $log`, Fluent Bit wraps events in JSON: `{"log":"~hash,var1,var2..."}`. The app expands the bare `~hash,...` line, which `event_key $log` sends.
 
     === ":simple-fluentd: Fluentd"
 
@@ -254,7 +274,7 @@ Get encoded events flowing to Splunk in under 15 minutes.
           index tenx_dml
           sourcetype tenx_dml_raw_json
           use_ssl true
-          ssl_verify false
+          ssl_verify true
         </match>
 
         # ========================= ENCODED EVENTS OUTPUT ====================
@@ -267,9 +287,9 @@ Get encoded events flowing to Splunk in under 15 minutes.
           port 8088
           token YOUR_ENCODED_EVENTS_HEC_TOKEN
           index your_logs_index
-          sourcetype your_sourcetype
+          sourcetype tenx_encoded
           use_ssl true
-          ssl_verify false
+          ssl_verify true
           <format>
             @type single_value
             message_key log
@@ -278,7 +298,7 @@ Get encoded events flowing to Splunk in under 15 minutes.
         ```
 
         !!! danger "Critical: format single_value"
-            Without the `<format>` block, Fluentd wraps events in JSON: `{"log":"~hash,var1,var2...","tag":"..."}`. The Splunk app cannot expand this format. Use `format single_value` with `message_key log` to send only the encoded log content.
+            Without the `<format>` block, Fluentd wraps events in JSON: `{"log":"~hash,var1,var2...","tag":"..."}`. The app expands the bare `~hash,...` line, which `format single_value` with `message_key log` sends.
 
     === ":simple-opentelemetry: OTel Collector"
 
@@ -293,16 +313,16 @@ Get encoded events flowing to Splunk in under 15 minutes.
             index: "tenx_dml"
             sourcetype: "tenx_dml_raw_json"
             tls:
-              insecure_skip_verify: true
+              insecure_skip_verify: false
 
           # Encoded events exporter
           splunk_hec/encoded:
             endpoint: "https://your-splunk-host.com:8088/services/collector"
             token: "YOUR_ENCODED_EVENTS_HEC_TOKEN"
             index: "your_logs_index"
-            sourcetype: "your_sourcetype"
+            sourcetype: "tenx_encoded"
             tls:
-              insecure_skip_verify: true
+              insecure_skip_verify: false
 
         service:
           pipelines:
@@ -328,16 +348,22 @@ Get encoded events flowing to Splunk in under 15 minutes.
     ```spl
     | inputlookup tenx-dml-lookup | stats count
     ```
-    :material-check-circle-outline:{ .success } Expected: Count > 0 (may take up to 2 minutes for first templates)
+    :material-check-circle-outline:{ .success } Expected: Count > 0 (up to 5 minutes for the first templates)
 
     **3. Check compact events expand:**
     ```spl
-    | tenxsearch searchstring="index=your_logs_index" | head 10
+    | tenxsearch searchstring="index=your_logs_index sourcetype=tenx_encoded" | head 10
     ```
     :material-check-circle-outline:{ .success } Expected: Full expanded events, not `~hash,var1,var2...` format
 
-    !!! tip "First Templates Take Time"
-        The "Consume KV" saved search runs every 2 minutes. If KV store is empty, wait 2-3 minutes and check again.
+    !!! tip "Templates indexed before the app"
+        The "Consume KV" saved search stores new templates every 5 minutes. To load templates indexed before the app was installed, run this search once as an admin or power user:
+
+        ```spl
+        index=tenx_dml sourcetype=tenx_dml_raw_json earliest=-30d | sendalert tenx_dml_to_kv
+        ```
+
+        Running it again is safe: templates already stored are skipped.
 
 ??? tenx-step-search "Step 5: Search from the Search Bar"
 
@@ -356,8 +382,8 @@ Get encoded events flowing to Splunk in under 15 minutes.
 
     `NOT`, `OR`, `AND`, parenthesised groups, wildcards, field conditions, inline `earliest=`/`latest=` and a trailing pipeline all behave as they do on the original data. The command also runs in saved searches, alerts and the REST API.
 
-    !!! warning "A search without the command returns zero"
-        A bare search on a compact sourcetype finds nothing and reports no matches, because the constant words are in the KV Store rather than the event. Keep compact indexes out of users' default index sets and name them so the omission is visible.
+    !!! info "Name compact indexes"
+        A search over a compact sourcetype reaches the original words through `tenxsearch`; without it, a keyword search returns no events. Keep compact indexes out of users' default index sets and name them in searches.
 
     !!! tip "Dashboards need no command"
         Classic dashboards in an app carrying `dashboard.js` keep their panel SPL unchanged. See [Expansion in Other Splunk Apps](#expansion-in-other-splunk-apps) below.
@@ -368,7 +394,7 @@ Get encoded events flowing to Splunk in under 15 minutes.
 
 Use this checklist to diagnose issues at each stage of the pipeline.
 
-??? tenx-checklist "Templates Arriving in Splunk?"
+??? tenx-checklist "Templates Arriving in Splunk"
 
     **Test Query:**
     ```spl
@@ -390,7 +416,7 @@ Use this checklist to diagnose issues at each stage of the pipeline.
     {"templateHash":"#ABC123xy","template":"INFO $0 - User $1 logged in from $2"}
     ```
 
-??? tenx-checklist "KV Store Populated?"
+??? tenx-checklist "KV Store Populated"
 
     **Test Query:**
     ```spl
@@ -405,20 +431,20 @@ Use this checklist to diagnose issues at each stage of the pipeline.
     **Verify saved search configuration:**
 
     1. Go to **Settings** → **Searches, reports, and alerts**
-    2. Find "Consume KV" in the 10x for Splunk app
+    2. Find "Consume KV" in the Log10x App
     3. Verify search string includes: `index=tenx_dml sourcetype=tenx_dml_raw_json`
     4. Click **Run** to manually trigger
 
-??? tenx-checklist "Events Expanding Correctly?"
+??? tenx-checklist "Events Expanding Correctly"
 
     **Test Query:**
     ```spl
-    index=your_logs_index | head 5
+    | tenxsearch searchstring="index=your_logs_index sourcetype=tenx_encoded" | head 5
     ```
 
     | Result | Meaning | Action |
     |--------|---------|--------|
-    | Full expanded events | Working correctly | Done! |
+    | Full expanded events | Expansion working | None |
     | `~hash,var1,var2...` format | Events not expanding | Check hash exists in KV store |
     | `{"log":"~hash,..."}` | JSON wrapping | Add `event_key $log` to forwarder |
 
@@ -439,21 +465,9 @@ Use this checklist to diagnose issues at each stage of the pipeline.
 
     | Cause | Solution |
     |-------|----------|
-    | Missing `index=` in saved search | Edit "Consume KV" search to include `index=tenx_dml` |
-    | Time window too narrow | Increase `dispatch.earliest_time` from `-3m` to `-1h` or `-1d` |
-    | Special characters in hash | Upgrade Splunk app - URL encoding fix required |
-    | Saved search disabled | Enable in **Settings** → **Searches** → "Consume KV" |
-
-    **Fix saved search manually:**
-
-    Edit `$SPLUNK_HOME/etc/apps/tenx-for-splunk/local/savedsearches.conf`:
-    ```ini
-    [Consume KV]
-    search = index=tenx_dml sourcetype=tenx_dml_raw_json
-    dispatch.earliest_time = -1d
-    ```
-
-    Restart Splunk or run the search manually to apply.
+    | Templates indexed before the app was installed, or while "Consume KV" was down | Run `index=tenx_dml sourcetype=tenx_dml_raw_json earliest=-30d | sendalert tenx_dml_to_kv` once |
+    | Saved search disabled | Enable in **Settings** → **Searches, reports, and alerts** → "Consume KV" |
+    | Templates in another index | Point the templates HEC token at `tenx_dml` |
 
 ??? tenx-troubleshoot "Events Show Raw Encoded Format"
 
@@ -463,7 +477,7 @@ Use this checklist to diagnose issues at each stage of the pipeline.
 
     | Cause | Solution |
     |-------|----------|
-    | Template hash not in KV store | Wait 2 min for "Consume KV" to run, or trigger manually |
+    | Template hash not in KV store | Wait 5 minutes for "Consume KV", or run the backfill search above |
     | Hash mismatch (different data) | Verify encoded events match templates in `tenx_dml` |
     | Search ran without expansion | On a dashboard, ensure `dashboard.js` is in that app; in the search bar, wrap the search in `tenxsearch` |
 
@@ -512,7 +526,7 @@ Use this checklist to diagnose issues at each stage of the pipeline.
           port 8088
           token YOUR_TOKEN
           index your_index
-          sourcetype your_sourcetype
+          sourcetype tenx_encoded
           <format>
             @type single_value
             message_key log
@@ -547,13 +561,13 @@ Use this checklist to diagnose issues at each stage of the pipeline.
     | Connection refused | HEC disabled | Enable in **Settings** → **Data inputs** → **HTTP Event Collector** → **Global Settings** |
     | 401 Unauthorized | Invalid token | Verify token value, check token is enabled |
     | 403 Forbidden | Token restrictions | Check token's allowed indexes and sourcetypes |
-    | SSL error | Certificate issues | Set `TLS.Verify Off` (dev) or configure proper certs (prod) |
+    | SSL error | Forwarder does not trust the HEC certificate | Install Splunk's CA certificate on the forwarder host; turn verification off only on a test instance |
 
 ---
 
 ## :material-code-tags: Expansion in Other Splunk Apps
 
-`dashboard.js` loads on every classic dashboard in the app that carries it. The 10x for Splunk app ships it, so its own dashboards expand. To expand classic dashboards in another app, copy the file there:
+`dashboard.js` loads on every classic dashboard in the app that carries it. The Log10x App ships it, so its own dashboards expand. To expand classic dashboards in another app, copy the file there:
 
 ``` { .console .copy }
 cp $SPLUNK_HOME/etc/apps/tenx-for-splunk/appserver/static/dashboard.js \
@@ -562,8 +576,8 @@ cp $SPLUNK_HOME/etc/apps/tenx-for-splunk/appserver/static/dashboard.js \
 
 Restart Splunk to load it.
 
-!!! info "What copying the hook does not cover"
-    The search bar and Dashboard Studio load no app JavaScript, so they are unaffected by the copy. Wrap the search in the `tenxsearch` command there, as in the Quickstart.
+!!! info "Search bar and Dashboard Studio"
+    The search bar and Dashboard Studio use the `tenxsearch` command, as in the Quickstart.
 
 ??? info "Programmatic Hook for Custom Views"
 
@@ -588,10 +602,10 @@ Restart Splunk to load it.
 | [**Search Handler**](https://github.com/log-10x/splunk-app/blob/main/tenx-for-splunk/bin/tenx_search_handler.py){target="\_blank"} | REST endpoint transforming SPL queries |
 | [**KV Store**](https://github.com/log-10x/splunk-app/blob/main/tenx-for-splunk/default/collections.conf){target="\_blank"} | Template patterns for event expansion |
 | [**Inflate Macro**](https://github.com/log-10x/splunk-app/blob/main/tenx-for-splunk/default/macros.conf){target="\_blank"} | SPL macro joining events with templates |
-| [**Consume KV Search**](https://github.com/log-10x/splunk-app/blob/main/tenx-for-splunk/default/savedsearches.conf){target="\_blank"} | Scheduled search populating KV store from templates |
-| [**Analytics Dashboard**](https://github.com/log-10x/splunk-app/blob/main/tenx-for-splunk/default/data/ui/views/tenx_dashboard.xml){target="\_blank"} | Encoding metrics and ROI visualization |
+| [**Consume KV Search**](https://github.com/log-10x/splunk-app/blob/main/tenx-for-splunk/default/savedsearches.conf){target="\_blank"} | Scheduled search storing new templates in the KV Store |
+| [**Analytics Dashboard**](https://github.com/log-10x/splunk-app/blob/main/tenx-for-splunk/default/data/ui/views/tenx_dashboard.xml){target="\_blank"} | Compression and template metrics |
 | [**Diagnostics Dashboard**](https://github.com/log-10x/splunk-app/blob/main/tenx-for-splunk/default/data/ui/views/tenx_diagnostics.xml){target="\_blank"} | Troubleshooting and verification tools |
 
 ---
 
-<br/>:material-github: This app is open source. View on [GitHub](https://github.com/log-10x/splunk-app "10x for Splunk"){target="\_blank"}.
+<br/>:material-github: This app is open source. View on [GitHub](https://github.com/log-10x/splunk-app "Log10x App"){target="\_blank"}.

package/build/product-kb/docs/apps/retriever/faq.md

@@ -124,7 +124,7 @@ The Retriever ships selected events from low-cost storage (S3, Azure Blobs) to l
 
     **Generic:** Any HTTP endpoint, syslog, or TCP destination. Logs stream with original timestamps preserved.
 
-    For Splunk users, the optional [Receiver in Compact mode](https://doc.log10x.com/apps/receiver/compact/){target="_blank"} compacts events at the source for an additional reduction in ingestion volume (modeled, varies by data). Events are expanded transparently via the [10x for Splunk](https://doc.log10x.com/apps/receiver/compact/splunk/){target="_blank"} app at search time.
+    For Splunk users, the optional [Receiver in Compact mode](https://doc.log10x.com/apps/receiver/compact/){target="_blank"} compacts events at the source for an additional reduction in ingestion volume (modeled, varies by data). Events are expanded transparently via the [Log10x App](https://doc.log10x.com/apps/receiver/compact/splunk/){target="_blank"} at search time.
 
     For Elasticsearch and OpenSearch users, the [L1ES plugin](https://doc.log10x.com/apps/receiver/compact/elasticsearch/){target="_blank"} expands compact events at query time. Kibana searches, dashboards, and alerts work unchanged on the original full data.
 
@@ -347,7 +347,7 @@ The Retriever ships selected events from low-cost storage (S3, Azure Blobs) to l
     The 10x compact format is fully expandable without relying on log10x infrastructure. Multiple open-source expansion tools are available:
 
     **1. Splunk App (Apache 2.0)**
-    - [10x for Splunk](https://github.com/log-10x/splunk-app){target="_blank"}, open-source app that automatically expands compact events
+    - [Log10x App](https://github.com/log-10x/splunk-app){target="_blank"}, open-source app that automatically expands compact events
     - Works as search-time macro: all your existing KQL queries work unchanged
 
     **2. Java Library and CLI (Apache 2.0)**

package/build/product-kb/docs/engine/launcher/extension.md

@@ -93,14 +93,14 @@ The [log10x MCP](https://doc.log10x.com/apps/mcp/) emits this entire plan from a
     The layer is published in every region below, for both architectures, and
     is readable by any AWS account. Nothing to build.
 
-    **Engine 1.1.79, republished 2026-09-17.** Every layer below carries the
+    **Engine 1.1.85, published 2026-09-28.** Every layer below carries the
     same build, so there is one digest per architecture rather than one per
     region:
 
     | Architecture | `CodeSha256` |
     |---|---|
-    | x86_64 | `ACkSX/XS5nei+rAm6eiKyyxabq3lwcAqvAeFu437dDo=` |
-    | arm64 | `DbhgTftIcnzEi+SenwH+YMotPX11sIavGQb6o17IBkU=` |
+    | x86_64 | `BzKA8X+RcLOJzgIn5xJVGrVDN/jSF81VtWDe4Raa/BE=` |
+    | arm64 | `bH1khDPOjASTfBvtLcnMEfFGel1TbPGzoNTO8ezvY+E=` |
 
     `aws lambda get-layer-version` returns that digest to any caller, so you can
     check what you are about to attach:
@@ -108,20 +108,20 @@ The [log10x MCP](https://doc.log10x.com/apps/mcp/) emits this entire plan from a
     ``` { .console .copy }
     aws lambda get-layer-version --region us-east-1 \
       --layer-name arn:aws:lambda:us-east-1:351939435334:layer:tenx-receive \
-      --version-number 8 --query Content.CodeSha256 --output text
+      --version-number 9 --query Content.CodeSha256 --output text
     ```
 
 
     | Region | x86_64 | arm64 |
     |---|---|---|
-    | `us-east-1` | `arn:aws:lambda:us-east-1:351939435334:layer:tenx-receive:8` | `arn:aws:lambda:us-east-1:351939435334:layer:tenx-receive-arm64:4` |
-    | `us-east-2` | `arn:aws:lambda:us-east-2:351939435334:layer:tenx-receive:4` | `arn:aws:lambda:us-east-2:351939435334:layer:tenx-receive-arm64:4` |
-    | `us-west-2` | `arn:aws:lambda:us-west-2:351939435334:layer:tenx-receive:4` | `arn:aws:lambda:us-west-2:351939435334:layer:tenx-receive-arm64:4` |
-    | `eu-west-1` | `arn:aws:lambda:eu-west-1:351939435334:layer:tenx-receive:4` | `arn:aws:lambda:eu-west-1:351939435334:layer:tenx-receive-arm64:4` |
-    | `eu-central-1` | `arn:aws:lambda:eu-central-1:351939435334:layer:tenx-receive:4` | `arn:aws:lambda:eu-central-1:351939435334:layer:tenx-receive-arm64:4` |
-    | `ap-southeast-1` | `arn:aws:lambda:ap-southeast-1:351939435334:layer:tenx-receive:4` | `arn:aws:lambda:ap-southeast-1:351939435334:layer:tenx-receive-arm64:4` |
-    | `ap-northeast-1` | `arn:aws:lambda:ap-northeast-1:351939435334:layer:tenx-receive:4` | `arn:aws:lambda:ap-northeast-1:351939435334:layer:tenx-receive-arm64:4` |
-    | `ap-south-1` | `arn:aws:lambda:ap-south-1:351939435334:layer:tenx-receive:4` | `arn:aws:lambda:ap-south-1:351939435334:layer:tenx-receive-arm64:4` |
+    | `us-east-1` | `arn:aws:lambda:us-east-1:351939435334:layer:tenx-receive:9` | `arn:aws:lambda:us-east-1:351939435334:layer:tenx-receive-arm64:5` |
+    | `us-east-2` | `arn:aws:lambda:us-east-2:351939435334:layer:tenx-receive:5` | `arn:aws:lambda:us-east-2:351939435334:layer:tenx-receive-arm64:5` |
+    | `us-west-2` | `arn:aws:lambda:us-west-2:351939435334:layer:tenx-receive:5` | `arn:aws:lambda:us-west-2:351939435334:layer:tenx-receive-arm64:5` |
+    | `eu-west-1` | `arn:aws:lambda:eu-west-1:351939435334:layer:tenx-receive:5` | `arn:aws:lambda:eu-west-1:351939435334:layer:tenx-receive-arm64:5` |
+    | `eu-central-1` | `arn:aws:lambda:eu-central-1:351939435334:layer:tenx-receive:5` | `arn:aws:lambda:eu-central-1:351939435334:layer:tenx-receive-arm64:5` |
+    | `ap-southeast-1` | `arn:aws:lambda:ap-southeast-1:351939435334:layer:tenx-receive:5` | `arn:aws:lambda:ap-southeast-1:351939435334:layer:tenx-receive-arm64:5` |
+    | `ap-northeast-1` | `arn:aws:lambda:ap-northeast-1:351939435334:layer:tenx-receive:5` | `arn:aws:lambda:ap-northeast-1:351939435334:layer:tenx-receive-arm64:5` |
+    | `ap-south-1` | `arn:aws:lambda:ap-south-1:351939435334:layer:tenx-receive:5` | `arn:aws:lambda:ap-south-1:351939435334:layer:tenx-receive-arm64:5` |
 
     Match the architecture to the function's own: `arm64` for Graviton,
     `x86_64` otherwise. A mismatch fails at INIT rather than silently.
@@ -245,19 +245,19 @@ The [log10x MCP](https://doc.log10x.com/apps/mcp/) emits this entire plan from a
     The published layer suits every case except one: baking a static mute file into the image, which pins the policy to the layer version. Build it from the release artifacts:
 
     ``` { .console .copy }
-    gh release download 1.1.79 -R log-10x/pipeline-releases \
-      -p 'tenx-edge-1.1.79-amd64-native' -p 'tenx-modules-1.1.79.tar.gz' \
-      -p 'tenx-config-1.1.79.tar.gz' -p 'tenx-symbols-1.1.79.10x.tar' \
+    gh release download 1.1.85 -R log-10x/pipeline-releases \
+      -p 'tenx-edge-1.1.85-amd64-native' -p 'tenx-modules-1.1.85.tar.gz' \
+      -p 'tenx-config-1.1.85.tar.gz' -p 'tenx-symbols-1.1.85.10x.tar' \
       -p 'build-receive-layer.sh'
 
     mkdir modules config symbols
-    tar xzf tenx-modules-1.1.79.tar.gz -C modules
-    tar xzf tenx-config-1.1.79.tar.gz -C config
-    cp tenx-symbols-1.1.79.10x.tar symbols/
+    tar xzf tenx-modules-1.1.85.tar.gz -C modules
+    tar xzf tenx-config-1.1.85.tar.gz -C config
+    cp tenx-symbols-1.1.85.10x.tar symbols/
 
     chmod +x build-receive-layer.sh
     ./build-receive-layer.sh \
-      ./tenx-edge-1.1.79-amd64-native ./modules ./config ./symbols \
+      ./tenx-edge-1.1.85-amd64-native ./modules ./config ./symbols \
       ./tenx-receive.zip \
       ./mutes.csv                  # the 6th argument is the policy file
 
@@ -268,4 +268,4 @@ The [log10x MCP](https://doc.log10x.com/apps/mcp/) emits this entire plan from a
       --content S3Bucket=<your-bucket>,S3Key=layers/tenx-receive.zip
     ```
 
-    Swap the bootstrap for `tenx-edge-1.1.79-aarch64-native` and the architecture for `arm64` to build the Graviton variant. With a mute file present the build validates every entry and refuses a malformed one, rather than shipping a disposition that would be silently skipped.
+    Swap the bootstrap for `tenx-edge-1.1.85-aarch64-native` and the architecture for `arm64` to build the Graviton variant. With a mute file present the build validates every entry and refuses a malformed one, rather than shipping a disposition that would be silently skipped.

package/build/product-kb/docs/faq/apps/retriever.md

@@ -124,7 +124,7 @@ The Retriever ships selected events from low-cost storage (S3, Azure Blobs) to l
 
     **Generic:** Any HTTP endpoint, syslog, or TCP destination. Logs stream with original timestamps preserved.
 
-    For Splunk users, the optional [Receiver in Compact mode](https://doc.log10x.com/apps/receiver/compact/){target="_blank"} compacts events at the source for an additional reduction in ingestion volume (modeled, varies by data). Events are expanded transparently via the [10x for Splunk](https://doc.log10x.com/apps/receiver/compact/splunk/){target="_blank"} app at search time.
+    For Splunk users, the optional [Receiver in Compact mode](https://doc.log10x.com/apps/receiver/compact/){target="_blank"} compacts events at the source for an additional reduction in ingestion volume (modeled, varies by data). Events are expanded transparently via the [Log10x App](https://doc.log10x.com/apps/receiver/compact/splunk/){target="_blank"} at search time.
 
     For Elasticsearch and OpenSearch users, the [L1ES plugin](https://doc.log10x.com/apps/receiver/compact/elasticsearch/){target="_blank"} expands compact events at query time. Kibana searches, dashboards, and alerts work unchanged on the original full data.
 
@@ -313,7 +313,7 @@ The Retriever ships selected events from low-cost storage (S3, Azure Blobs) to l
     The 10x compact format is fully expandable without relying on log10x infrastructure. Multiple open-source expansion tools are available:
 
     **1. Splunk App (Apache 2.0)**
-    - [10x for Splunk](https://github.com/log-10x/splunk-app){target="_blank"}, open-source app that automatically expands compact events
+    - [Log10x App](https://github.com/log-10x/splunk-app){target="_blank"}, open-source app that automatically expands compact events
     - Works as search-time macro: all your existing KQL queries work unchanged
 
     **2. Java Library and CLI (Apache 2.0)**

package/build/product-kb/docs/faq/general.md

@@ -170,7 +170,7 @@ description: "What the 10x Engine does, the measured 63.7% lossless reduction on
     - **[Receiver, Compact mode](https://doc.log10x.com/apps/receiver/compact/)**: losslessly compacts events before ingestion where the destination supports it (Splunk, self-hosted Elasticsearch/OpenSearch)
     - **[Retriever](https://doc.log10x.com/apps/retriever/)**: offloads selected events to your own S3 bucket and fetches the exact events back to your analyzer on demand
 
-    The open-source [10x for Splunk](https://doc.log10x.com/apps/receiver/compact/splunk/) app auto-expands compact logs at search time. For other analyzers, [Retriever](https://doc.log10x.com/apps/retriever/) expands and streams events on-demand.
+    The open-source [Log10x App](https://doc.log10x.com/apps/receiver/compact/splunk/) auto-expands compact logs at search time. For other analyzers, [Retriever](https://doc.log10x.com/apps/retriever/) expands and streams events on-demand.
 
 ??? tenx-compare "How does 10x differ from APMs and OpenTelemetry"
 

package/build/product-kb/docs/faq/stacks/splunk/comparisons.md

@@ -73,9 +73,9 @@ title: "Comparisons"
        - [ ] Check logs for startup errors: `kubectl logs -l app=log10x-receiver`
 
     3. **Install Splunk App**
-       - [ ] Download [10x for Splunk](https://github.com/log-10x/splunk-app/releases){target="_blank"} from GitHub
+       - [ ] Download [Log10x App](https://github.com/log-10x/splunk-app/releases){target="_blank"} from GitHub
        - [ ] Install via Splunk UI: Apps → Install app from file
-       - [ ] Verify installation: Settings → Installed apps (should show "10x for Splunk")
+       - [ ] Verify installation: Settings → Installed apps (should show "Log10x App")
 
     4. **Configure KV Store**
        - [ ] Create KV Store collection `tenx_dml` with required schema
@@ -90,7 +90,7 @@ title: "Comparisons"
 
     **Rollback procedure (if needed):**
     - **Remove Receiver:** `helm uninstall log10x-receiver` (logs resume at full volume)
-    - **Remove app:** Splunk UI → Apps → Uninstall 10x for Splunk
+    - **Remove app:** Splunk UI → Apps → Uninstall the Log10x App
     - **Both actions are safe:** No configuration changes needed, no data loss
 
     **Compatibility checklist before full deployment:**