Yes, mixed up the terms 🙂 so why don´t you use one of those? ... View more

HI, why don´t you use a non violation licence? With 6.5.0 you can request one of these, then you will not have to reset your license when you have 5 violations. https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Aboutlicenseviolations ... View more

any luck with that? Please accept the answer if it helped 🙂 ... View more

There is an alternate option where you can analyze checkpoint logs via syslog. This add-on will help you analyze Check Point logs on Windows. https://splunkbase.splunk.com/app/2996/ ... View more

HI, I can´t find it anymore, but I once read that searches running as nobody will have a lower priority for the scheduler. But since nobody is often applied as user for e.g. apps, when they get installed, I don´t see any reason to change this. Never had any bad experience with user nobody. ... View more

Hi Have you seen this post? https://answers.splunk.com/answers/1295/how-do-i-make-a-report-save-to-a-share-on-a-different-server-every-24-hours.html ... View more

HI, not 100 % sure, bit I think what is needed is, on top of user role, edit_tcp list_settings schedule_search ... View more

HI, your fishbucket is stored in $SPLUNK_HOME/var/lib/splunkforwarder/fishbucket . It keeps track how much of your file/files you want to monitor has been read already So when you restart your server, it seems to be that this information is then missing, and it reads all the files again. So could it be that you forwarder fishbucket is deleted? What forwarder version are you running? Read this for more infos : https://www.splunk.com/blog/2008/08/14/what-is-this-fishbucket-thing.html ... View more

Btool on splunk: Open cmd with admin rights and type splunk.exe cmd btool I think ... View more

Hi, maybe the official doc for trouble shooting this could add some value https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Cantfinddata ... View more

HI, just to shed some light on this: The problem is that the fishbucket on your forwarder is not keeping track of your logs, not the one on your indexer. Could it be that somehow the fishbucket on your forwarders is getting deleted regularly ? Or maybe two inputs pointing to the same WinEventLog://Security source? you can check with btool. ./splunk cmd btool inputs list --debug | grep *://Security ... View more

HI, I guess you had a look at this: https://docs.splunk.com/Documentation/Splunk/7.2.3/DistSearch/Migratefromstandalonesearchheads If you read futher down its says: You can migrate custom settings in the app itself by moving them to a new app and exporting them globally. The migration procedure in this topic includes a step for this. So just perform whats stated here: https://docs.splunk.com/Documentation/Splunk/7.2.3/DistSearch/Migratefromstandalonesearchheads#Migrate_settings_to_a_search_head_cluster ... View more

HI, you can blacklist your input on forwarder side. Try something like: inputs.conf [monitor://<your_path>] blacklist = regex sourcetype = your sourcetype index = your index How does your log look like? maybe you can set the regex to status=200 that could be it. ... View more

HI, it also could be that your coworkers have a field extraction in their /etc/users folder that is interfering with yours, meaning e.g. you both try to extract a "action" field, private will always take precedence over in app shared objects. ... View more

Just test the config for cloning I posted. Its working ... View more

Sure just have a look at the docs about cloning. ... View more

HI, maybe this could answer your question? https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_MapReduce.pdf ... View more

HI, is /var/log/cron the source which is displayed with this events? Could it be that it is /var/log/cron.log ... View more

If you HF can send to both indexer via recieving port 9997 I don´t see why this should not work. You can also set up your HF to be a gateway forwarder for other UF´s https://docs.splunk.com/Documentation/SplunkCloud/7.2.3/Data/Forwarddata ... View more

HI, depends on how your macro is set up, if it also starts with a pipe, its logical that it will not work if you have two. ... View more

HI, sure you can send data to both indexer. Splunk automatically load balance incoming data to indexer you specify in outputs.conf Like this [tcpout: my_LB_indexers] server=10.10.10.1:9997,10.10.10.2:9997 OR if you want to clone the data like this: [tcpout] defaultGroup=indexer1,indexer2 [tcpout:indexer1] server=10.1.1.197:9997 [tcpout:indexer2] server=10.1.1.200:9997 docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Configureforwardingwithoutputs.conf#Configure_data_cloning_on_a_universal_forwarder_with_outputs.conf ... View more

HI, if you have an extracted field, your interesting, selected fields and "more fields" should provide you with the percentage of the coverage of each field, did you had a look at this? Just click on the field, under the name its listed like : 15 Values, 26.215% of events ... View more

HI what could help you to understand delayed indexing, you could have a look at the delta between time and index time. | eval delta=_indextime-_time If the value for delta is high you might experience delay of log ingestion. ... View more

If this helped please accept the answer 🙂 ... View more

HI, maybe this could help you? https://social.technet.microsoft.com/Forums/windows/en-US/db2719af-387c-499f-afd5-74ea021ce135/audit-failure-4776-blank-workstation?forum=winserverDS ... View more