There are a few ways to onboard data into Splunk. Install a universal forwarder on the server to send log files to Splunk Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog Use the server's API to extract data for indexing Use Splunk DB Connect to pull data from the server's SQL database.

Thanks for the response.. @Giuseppe. where do you locate the conf files? The conf files are located at the first full splunk instance that the data pass through. Regarding the REGEX, what I am trying to achieve is data to be routed to the specified index in transforms.conf based on the field name and it's value. In this case, what I am looking for is whenever, there is a <namespace="drnt0-retail-sabbnetservices"> in the data I want the routing to work. Regards, Yaseen.   Regards, Yaseen.    

Hi @syaseensplunk, at first: where do you locate the conf files? they must be located in the Heavy Forwarder that you're using to take logs from Kubernetes or in the first Full Splunk instance that the data pass through. Second question: are you sure that the regex that you inserted in transforms.conf matches the events to override index? Ciao. Giuseppe

In your first Splunk instance, there should be one or more workflow_actions.conf files containing the configurations of your workflows. You should copy them to your second Splunk machine. Ref: https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/Workflow_actionsconf

Hi @Mahendra.Shetty  Not sure if this is what you looking for: from selenium import webdriver from selenium.webdriver.common.by import By driver = webdriver.Chrome() driver.get('https://www.cookiebot.com/en/uk-ie-cookie-compliance/') waitTime=30 # Accept cookies try: cookie_button = driver.find_element(By.ID, 'CybotCookiebotDialogBodyLevelButtonLevelOptinAllowAll') print("button located") cookie_button.click() except Exception as e: print("cannot find button") Take the given website for instance, upon loaded it prompts for cookie acceptance/acknowledgement: "Deny", "Customize" or "Allow all". In this example, I simply accept i.e., "Allow all". To do that, using browser dev tool, we  can inspect the ID of that link button.  regards, Terence

You would probably find the splunk Add-on for ServiceNow useful: https://splunkbase.splunk.com/app/1928 As for the query, you could compare the list of splunk server names active now versus the servers active a few days ago. e.g. index=_internal host="*splunknamescheme*" OR host IN (splunkserver1, splunkserver2) earliest=-3d latest=-2d | dedup host | table host | search NOT [search index=_internal host="*splunknamescheme*" OR host IN (splunkserver1, splunkserver2) earliest=-1d | dedup host | table host]  Then you can add an Alert Action to the alert and make it create an incident: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions

Try using Splunk Cloud to solve a problem at your organization.  For example: Are all hosts up and running as expected? Are any hosts running short on resources (free memory or disk space, CPU)? Are all applications up and running as expected? Has someone tried to brute-force their way into an account? I'm sure you can think of others.  Check out the Splunk Security Essentials app for security-related suggestions.

There are a few ways to onboard data into Splunk. Install a universal forwarder on the server to send log files to Splunk Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog Use the server's API to extract data for indexing Use Splunk DB Connect to pull data from the server's SQL database. Have the application send data directly to Splunk using HTTP Event Collector (HEC).

Hi @vijreddy30, let me understand, quich kind of HA do you want to  impement? if HA on data, you need an Indexer Cluster: you need at least two Indexer and a Cluster master, you can find more information at https://docs.splunk.com/Documentation/Splunk/9.1.2/Indexer/Basicclusterarchitecture If Ha in the presentation Layer, you neet a Search Head Cluster:, at least three Search Heads and a Deployer, as described at https://docs.splunk.com/Documentation/Splunk/9.1.2/DistSearch/SHCarchitecture If at ingestion level, you need at least two Heavy Forwarders and a Load Balancer. Ciao. Giuseppe