Hey Guys I have a right one here. So I have a bunch of systems in a DMZ forwarding to a heavy forwarder that then forwards onto out main LAN forwarder. All the systems in the DMZ are sending logs as you would expect except for one. At this point, I need to make clear that no firewall changes have been made, no network configs, absolutely nothing network related has been changed. The systems have all been upgraded to 6.2.2 and, as explained, all are working except one. If I look in the deployment monitor tool, the problem machine is listed and looks to be working fine. If I try and search the logs. that is not the case; there is nothing. I can search the other system logs without issue. I have removed and reinstalled the forwarder multiple times now with no luck. I am now investigating the logs which seem to be pointing to some sort of networking issue **Connection to host ***.***.***.*** failed** and No connections could be made to the host because the machine actively refused it, and also could not send data to output queue (parsingqueue, retrying along with Connection cooked) As I say all the other systems are working as expected and no changes have been made to the systems network / firewall settings. It seems to be some sort of installation corruption maybe? Has anyone got any ideas what I can do or where I can look to get more of an idea on how to get this resolved? Edit: Just an addition, not sure if it means anything, but in the Deployment monitor, the problem server is listed twice on the new and old version. Could there be some sort on conflict somehow on the problem server where its half installed or something daft? ... View more

Hi Guys I have my Index archive data as per the below index config: [default] frozenTimePeriodInSecs = 62899200 [_audit] maxTotalDataSizeMB = 20000 frozenTimePeriodInSecs = 62899200 coldToFrozenDir = F:\archive\audit [_internal] maxTotalDataSizeMB = 20000 frozenTimePeriodInSecs = 62899200 coldToFrozenDir = F:\archive\internal [_thefishbucket] maxTotalDataSizeMB = 20000 frozenTimePeriodInSecs = 62899200 coldToFrozenDir = F:\archive\fishbucket [history] maxTotalDataSizeMB = 20000 frozenTimePeriodInSecs = 62899200 coldToFrozenDir = F:\archive\history [main] maxTotalDataSizeMB = 4000000 frozenTimePeriodInSecs = 62899200 coldToFrozenDir = F:\archive\main [splunklogger] maxTotalDataSizeMB = 20000 frozenTimePeriodInSecs = 62899200 coldToFrozenDir = F:\archive\splunklogger [summary] maxTotalDataSizeMB = 20000 frozenTimePeriodInSecs = 62899200 coldToFrozenDir = F:\archive\summary So I have in the F: drive my archive folder with all the above archived data in it. What I need to know is, is it safe to move this folder elsewhere as it's getting large now and will the archive job continue to archive as it hits the above pre reqs ? I assume that once removed, this data will no longer be available when running Splunk searches. ... View more

Hi Guys I have seen a few posts dotted around relating to dragging in data from the EPO DB with an App called DBConnect, Ive managed to get that installed and connected to the DB however when trying to add a database input it gets a little confusing. When trying to configure using the GUI - I figure that I only need new evets so have picked the Tail input type Selected the Database created earlier Table name would be set to dbo.EPOAuditEventMsgs........ is that the correct table for AV Alerts ? Raising column seems to be a sticking point with various diffrent posts around the forum on this, I believe that it should be set to EPOEvents.AutoID......... is this correct ? Then as for Output, timestamp etc I assume they can be left blank ? Any help on this woud be much appreciated, I have little to no knowledge on SQL and Splunk is very much a work in progress too. Thanks in advance ... View more