Getting Data In

Direct syslog forwarding from Isilon to Splunk


I am trying to setup syslog forwarding from Isilon Cluster to Splunk server ... I have done the following steps as per instructions online.

1. edit syslog.conf file in cluster
2. create a read only user in splunk
3. Deploy the DELL EMC app and TA on deployment server.

Currently I can see that all of the cluster nodes are talking to my server but all TCP state for the nodes are in TIME_WAIT. I am also unable to detect any connection with the cluster from the Splunk UI. I tried setting up the TA with the read only user I had created. But that is also throwing "authentication" error.

I am new to Splunk and am no expert.
I am unable to understand what I have missed. Requesting help from the Splunk community.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

tag as datamodel attribute

I'm confused a bit. I use CIM datamodels.The "tag" field is both a filter for choosing events applicable to a ...

Index with one sourcetype - search performance / best practices

Hello,I have created a few indexes, each containing data only from one source with one sourcetype.<BR />From a ...

Can you customize Additional Fields in Notable Events?

Is there a way to customize which additional fields to show for which Notable event /Co-relation search ...