Hello! We want to integrate McAfee ePO into a Splunk Cloud, but we only found tutorials on syslogging data. I've been looking and I don't think it's possible to syslog in to Splunk Cloud. How can we do it?   Thanks!

Hi there, I'm sitting here trying to make sense of the different search types in Splunk (i.e. Dense, Sparse, Super-sparse, and Rare), how they affect performance and why that is.  I get that a Dense search, when you e.g. are searching for literally any index, then there is no point in utilising bloom filters because there is no need to rule out buckets to find specific events. However,  why isn't it beneficial for Sparse and Super-sparse searches to make use of Bloom filters?

Hi, I am trying to pull a data from a csv through deployment app but only the field names are getting indexed , data is not getting indexed. Number of records in csv is around 70000. Tried through dbconnect but from there also same issue. Is there any limit of data which can be indexed at a time. If yes, where can that be verified? Thanks  

  We have logs coming in from one of the source in CEF format. How to deal CEF Format data parsing in Splunk so that it get auto converted in field value pair. Post that i could alias those fields basis on my datamodel need. Kindly suggest. Thanks in advance  

Hello, I am trying to track failed logons followed by a successful one using the transaction command and the following criteria: Limit the time span to 5 min,  add a startswith so each transaction will begin with a logon failure, add an endswith so each transaction will end with logon success and add a | where to find when the eventcount exceeds 3 this is what I have so far  

the agent was reported successfully  until the following error happened ِِERROR NetVizAgentRequest - Fatal transport error while connecting to URL [http://127.0.0.1:3892/api/agentinfo?timestamp=0&agentType=APP_AGENT&agentVersion=0.10.0]: org.apache.http.conn.HttpHostConnectException: Connect to 127.0.0.1:3892 [/127.0.0.1] failed: Connection refused (Connection refused)

Hey guys! This is my first question here, so I'm sorry if I'm not being clear. I want to enrich the data we have and add a few fields with data that I receive from an external API. For this, I want to create a custom command to receive a field name and add run a python code to send requests to the API with the field values and create new fields with the additional data for each row. I have no experience with creating new commands with python, so I'd much appreciate an explanation how to do it (or if you have a better idea how to implement this) and some examples to rely on. Thanks!

I opened report acceleration for a report.The acceleration summary build well when user role has no Search filter restrictions. But as long I add any search filter restrictions for the role,the acceleration summary will never start to build. In page Report Acceleration summaries,the summary status shows that the progress is 0. Can anyone tell me why this happens?Any response will be appreciated

Hi dear splunk community, Can someone help me to convert/translate the following syslog-ng config to the corresponding rsyslog server side config please ? The standard syslog-ng.conf file simply includes the statements below which are in a file in the conf.d dir like so: @include "/etc/syslog-ng/conf.d/*.conf" I'd really appreciate it.  It doesn't have to be perfect or exact or even completely converted, as long as most of it can be  translated...the main concerns being the audit logs and all the rest of the program logs... Thanks so very much,   source s_remote { syslog(port(514), transport(tcp), flags(), max-connections(100),log-fetch-limit(100),log_iw_size(20000)); }; destination d_kern { file("/var/log/syslog-to-splunk/$HOST/kernel.log" create-dirs(yes)); }; destination d_mail { file("/var/log/syslog-to-splunk/$HOST/mail.log" create-dirs(yes)); }; destination d_daemon { file("/var/log/syslog-to-splunk/$HOST/daemon.log" create-dirs(yes)); }; destination d_auth { file("/var/log/syslog-to-splunk/$HOST/auth.log" create-dirs(yes)); }; destination d_cron { file("/var/log/syslog-to-splunk/$HOST/cron.log" create-dirs(yes)); }; destination d_security { file("/var/log/syslog-to-splunk/$HOST/audit.log" create-dirs(yes)); }; # All else. destination d_rest { file("/var/log/syslog-to-splunk/$HOST/program/$PROGRAM.log" create-dirs(yes)); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon, user, syslog); }; filter f_auth { facility(auth, authpriv, security); }; filter f_cron { facility(cron); }; filter f_security { facility(kern, auth, authpriv, security, local7); }; filter f_rest { not facility(auth, authpriv, cron, kern, mail, user, security, syslog); }; log { source(s_remote); filter(f_kern); destination(d_kern); }; log { source(s_remote); filter(f_mail); destination(d_mail); }; log { source(s_remote); filter(f_daemon); destination(d_daemon); }; log { source(s_remote); filter(f_auth); destination(d_auth); }; log { source(s_remote); filter(f_cron); destination(d_cron); }; log { source(s_remote); filter(f_security); destination(d_security); }; log { source(s_remote); filter(f_rest); destination(d_rest); };