This is actually a question to your local Splunk sales representative (or your local Partner since you're probably purchasing licenses through a Partner). Typically your ES license must match your main SE license volumewise and I've never seen it otherwise. The general idea is that all data you are indexing can be used for ES purposes so the only case where you might be able to have a "partial" ES situation would be if you had two separate licences for two separate environments - one with ES and one without. But that in itself is not something you'll easily get.- honestly I'm not sure if you can get such deal unless you are a huuuuuge customer and have completely disconnected environments (otherwise you're supposed to use a single license manager and split your license into separate licensing stacks). Bottom line is - your ES license must match the size of your main SE license and it is highly unlikely you'll get it otherwise.

Hi @phanikumarcs , probably Splunk doesn'r recognize the timestamp field and format you configured: in your data I don't see the field "timestamp" with the format %Y-%m-%d %H:%M:%S, where is it? Try to manualli add a sample of these data using the Add Data function that guides you in the sourcetype creation. Ciao. Giuseppe

I don't know how your licensing differentiates between "Splunk Core" logs and "ES" logs, but if you can find out the technical measure that Splunk uses to decide which category the logs belong to, then there should be a way to configure your Splunk environment to shift logs one way or the other. E.g. if it's based on sourcetypes or indexes, then those can be changed with props.conf and transforms.conf if it's based on data models, then those can be changed with eventtypes and tags if it's based on indexers, then that can be changed with the indexer architecture

Using "| fields _raw" should not remove information from the raw data recorded from the file into the event, it should only remove the extracted fields from your search results. If the missing details are not in the extracted fields, and are not present in the events before applying "| fields _raw" but are present in the files, then there could be a problem with indexing the content of the file into events.

Hey thanks for the reply! Honestly, I forgot about this post or I would have updated it. It seems like the add-on is for a different version of the Barracuda Email Defense than we have. The Barracuda syslog documentation shows a log format that is different than what our cloud platform is sending, but does match what this add-on is looking for. I believe the add-on may be for a self-hosted or on-prem solution. I was able to parse our logs by a field extraction spath on the extracted JSON. Unfortunately, nothing in the logs easily indicates email directionality, so that's a pain.

Are you referring to the "Splunk Add-on for VMware"? I believe the "Splunk Add-on for VMware ESXi Logs" only provides Splunk knowledge objects like field extractions. If so, then yes you can use the heavy forwarder as a data collector node. It defaults to using 10 workers which can be adjusted depending on how much load you expect and how beefy your machine is. I would recommend monitoring the CPU and RAM usage on your heavy forwarder after activating it, to ensure you are within limits. If you have extra CPU and RAM, then you can also install other apps and services on the heavy forwarder.

It appears you have set this addon up correctly.  Do you have other sourcetypes like "barracuda_scan", "barracuda_recv", or "barracuda_send"? This addon appears to intake the "barracuda" sourcetype, then use transforms to change the sourcetype to barracuda_<type> and then those other sourcetypes would then have fields extractions. If you have logs with the sourcetype "barracuda" but match the regex: "\d{10}\s\d{10}\sRECV" (a ten-digit number, then a space, then a ten-digit number, then the word "RECV"), then that would mean something is not working with the transform.

From reading the latest splunk_app_db_connect/README/db_inputs.conf.spec file, there do not seem to be "is_template" or "use_json_output" keys. Perhaps they existed in a previous version of the app. From which version of the DB Connect app were you upgrading?

1. This is a very old thread. You have a new problem, possibly only partially (if at all) connected to the original question. Please create a new thread describing your goal and what you tried so far. 2. Speaking of "what you tried so far" - have you checked the docs? Have you tried doing anything on your own yet?

I have requirement and am not sure if i can achieve this through this method. For example if i create an Search whihc is not logging or down, and can i create a run a custom script to check by telnetting or ping for the results came from search? Is this possible? How i can pass the values of the hostnames to the script?

The main question is whether you don't know how to use API to perform searches in which case you should star with https://docs.splunk.com/Documentation/Splunk/9.2.1/RESTREF/RESTprolog or whether you don't know how to use podman correctly - this is out of scope of this forum but maybe someone with experience with this tool can give a hint or two.

Hi, my issue got resolved. It's weird but I have tried changing different "Visualization Type" and to my surprise Line chart suddenly started populating graphs for all the options I have selected in the dropdown.  

There are different REST endpoints for Splunk to start or retrieve searches. Some will start a search and return a search ID, others will retrieve results from a previous search job. Probably the most straightforward is the /jobs/export one, which starts a job and returns results, though this will take time for the started search to complete. An example request for this endpoint would be: curl -k -u <user_in_splunk> https://<yoursplunkhost>:8089/services/search/v2/jobs/export -d search="<yoursplsearch>" E.g. curl -k -u svc_aas -d search="search index=aas sourcetype=syslog" https://splunk-prod-api.internal.xxxx.com:8089/services/search/v2/jobs/export Note that this curl request will request a password for the splunk user. There may be functionality in postman to supply this password.