Interesting, we had yesterday a similar question about syslog at How to calculate volume of syslog traffic on syslog-ng server ... View more

Truly, you need to worry about the frozenTimePeriodInSecs = 31536000 - 60 * 60 * 24 * 365 and maxTotalDataSizeMB = 20000 - 50 * 365 + some space . Since maxTotalDataSizeMB has a default of 1/2 TB you don't need to set it up, considering your volume. ... View more

Makes perfect sense @kmorris_splunk - thank you! ... View more

Meaning, preventing them from creating any knowledge objects in any app? that's a bit much... ... View more

Interesting thing @woodcock. -- 1: Remove the capability to save knowledge objects entirely. Where exactly? -- 2: it's pretty sad that we need to do something like this in the back-end... ... View more

It seems that you have the Zule Z there ; - 2019-05-31T13:17:14.002Z A bit about it at - What is a trailing Z in a time stamp? ... View more

@jaxjohnny2000, more about pass4symmkey at Secure your clusters with pass4SymmKey And to be clear it says there - pass4SymmKey controls authentication between Splunk instances and does not manage user access. ... View more

The following from Configure event line breaking explains it - -- How Splunk software determines event boundaries Splunk software determines event boundaries in two steps: Line breaking, which uses the LINE_BREAKER attribute regular expression value to split the incoming stream of bytes into separate lines. By default, the LINE_BREAKER is any sequence of newlines and carriage returns (that is, ([\r\n]+)). Line merging, which only occurs when you configure the SHOULD_LINEMERGE setting to "true" (the default). This step uses all the other line merging settings (for example, BREAK_ONLY_BEFORE, BREAK_ONLY_BEFORE_DATE, MUST_BREAK_AFTER, etc.) to merge the previously separated lines into events. If the second step does not run (because you set the SHOULD_LINEMERGE attribute to "false"), then the events are the individual lines that the LINE_BREAKER attribute determines. The first step is relatively efficient, while the second is relatively slow. Appropriate use of the LINE_BREAKER regular expression can produce the results you want in the first step. This is valuable if a significant amount of your data consists of multiline events. I had a similar thread at How can we index an entire XML document as one event? The solution by @somesoni2 worked perfectly well - [yoursourcetype] LINE_BREAKER = ([\r\n]+)(?=\<mlcpMetricsModel ) SHOULD_LINEMERGE = false TIME_PREFIX = \<reportDate\> TIME_FORMAT = %Y-%m-%dT%H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 19 LINE_BREAKER = ([\r\n]+)(?=\<mlcpMetricsModel ) does the work here and the logic provided by SHOULD_LINEMERGE is disabled by setting it to false . ... View more

It's an ISO thing; https://www.iso.org/iso-8601-date-and-time-format.html ... View more

The SE said - Means it's Zulu time (UTC time with no offset) as defined by ISO 8601. ... View more

For the record, this one worked for us - curl "https://<HEC service>:443/services/collector/event" -H "Authorization: Splunk f5b9eac2-7319-4dfb-80d0-86f44a9785cd" -k -d "{\"host\":\"xxxx\",\"sourcetype\":\"test_hec\",\"source\":\"test\",\"event\":{\"message\":\"ERROR\",\"code\":\"401\"}}" ... View more

@sanjeev543, normally these deployments apps are tiny and dedicated to the contract between the forwarder and the back-end Splunk. I'm not aware of breaking them down to what is sent to the forwarder and what is not. ... View more

On which server are you running the btool command, the forwarder or the deployment server? ... View more

A colleague said - -- I just finished testing several different versions of Splunk to understand how the deployment server behaves when the sequential number breaks and starting from 6.4, the numbers can definitely be non-consecutive. Versions prior to 6.4 did not like any breaks and would stop evaluating the severclass once the sequence changed. ... View more

Our SE said - From the serverclass.conf docs page - whitelist.<n> = <clientName> | <IP address> | <hostname> | <instanceId> blacklist.<n> = <clientName> | <IP address> | <hostname> | <instanceId> 'n' is an unsigned integer. The sequence may start at any value and may be non-consecutive. ... View more

For reference @chrispounds, this beautiful answer by @acharlieh at What is the basic difference between the lookup, inputlook and outputlookup commands ... View more

A starting point can be at Using Syslog-ng with Splunk ... View more

Are these Cisco Meraki Firewall logs on disk already? ... View more

@jeremyjh, extra information at Configure automatic key-value field extraction KV_MODE = none -- Disables field extraction for the source, source type, or host identified by the stanza name. Use this setting to ensure that other regular expressions that you create are not overridden by automatic field/value extraction for a particular source, source type, or host. Use this setting to increase search performance by disabling extraction for common but nonessential fields. We have some field extraction examples at the end of this topic that demonstrate the disabling of field extraction in different circumstances. ... View more