Hi @gyarici, I had the same problem and I received this answer both from Community and Splunk Support: if you have an intermediate Heavy Forwarder isn't possible to do this on Indexers. But you can do the fork at Heavy Forwarder level. Ciao. Giuseppe ... View more

Hi @02sangeet, about the first error, the correct paramer is: maxTotalDatasizeMB = 1024 as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Indexesconf About the second, I don't see any formal error, are you sure of value of 4? default is 300! check if there's a special char like tab. Ciao. Giuseppe ... View more

Hi @rcastello, what's your problem: have you events with EventCode=5137 OR EventCode=5136 OR EventCode=5141 or not? if not, did you checked if GPO events are logged (by default this logging is disabled!)? If instead you have events, check if the problem in in the match with ldapfilter (in other words, see what result you have without ldapfilter). In addition, for my knoledge, the EventCode for policy changes is 4719. At least, usually WinEventLog:Security events are in the wineventlog index, so you don't need to search in all indexes (your search is slower!). Ciao. Giuseppe ... View more

Hi @annageorgiou, as @renjith.nair said, after stats command you have only the fields of stats command, in your case only TotalSent, TotalRcvd and app; to use some other fields you have to use other functions like values, sum, max, avg. So in your search, try: index= * | eval TotalMB=round((TotalSent+TotalRcvd)/1024/1024,2) | eval TotalGB=round(TotalMB/1024,2) | stats sum(sentbyte) AS TotalSent, sum(rcvdbyte) AS TotalRcvd values(TotalGB) AS TotalGB by app | addtotals | sort limit=30 - total p.s.: you don't need dedup after stats. Ciao. Giuseppe ... View more

the problem is that after stats command you have only the fields the are in the stats, in your example you have only Field1Total, probably you have to use evenstats command or the values option of stats. index=index_name | eventstats count(Field2) as Field2Total | eval Difference=Field2Total - Field1Total | table Difference or index=index_name | stats count(Field2) as Field2Total values(Field1) as Field1Total | eval Difference=Field2Total - Field1Total | table Difference Ciao. Giuseppe ... View more

Hi @evelenke, as you said, IP or hostname could be not useful if you can receive from a server both by Universal Forwarder or syslog. You can easily identify syslogs (TCP:514 or UDP:514) and DB-Connect (db...), the others are different but they always come from Universal Forwarder. Another way to identify sources from Universal Forwarders is that you surely have also logs from these servers in _internal. Ciao. Giuseppe ... View more

Hi @orja_luaces, you don't need to install a Universal Forwarder if you already have a Splunk Enterprise instance. It's always a best practice to send all the logs of all Splunk servers to Indexers, so you already should have set your Splunk instances to forward logs. So you can configure inputs on your servers and take Linux logs from all of them. If you need only /var/log/messages, you can enable the relative input by GUI on by one, otherwise, you could also install the TA_nix app to monitor all the server functions (cpu, memory, etc...) and deploy it manually or using the Deployment server or Master Node (if you have an Indexer Cluster) or Deployer (if you have a Search Head Cluster) . Ciao. Giuseppe ... View more

Hi @evelenke, you should divide them by source field: syslogs have TCP:port or UDP:port; Universal Forwarder have the file or the script or the module; DB-Connect has db... (I'm not sure about this but you can check easily!). Ciao. Giuseppe ... View more

Hi @grivera_kudaw, you can delete dashboards from UI interface as an administrator. My hint is to search in _internal how long they aren't used: index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=uri "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="search" dashboard!="home" dashboard!="alert" dashboard!="lookup_edit" dashboard!="@go" dashboard!="data_lab" dashboard!="dataset" dashboard!="datasets" dashboard!="alerts" dashboard!="dashboards" dashboard!="reports" dashboard!="report" or index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=uri "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard="my_unused_dashboard" so you can be sure that the dashboard is unused in the last period. To be more sure you could also change access rights on the deleting dashboards (recording old rights) and wait for a period that none shous! Then you can delete them from UI interface as an administrator, eventually copying sources in a test off-line file. Ciao. Giuseppe ... View more

Hi @kbang, At first you need only of Universal Forwarder, not of Heavy Forwarder. The installation of Splunk Universal Forwarder is manual or using an external SW Distribution tool. When the UF is installed on all your target servers, you can deploy configurations to all of them using a role of your Splunk Server: the Deployment Server (for more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.1/Updating/Aboutdeploymentserver ). In other words you have to create a set of Apps (called Technical Add-Ons) to deploy to all your server or a part of them. e.g. at first, you could create a TA called TA_Forwarders containing only outputs.conf and deploymentclient.conf files: the first addresses the Splunk server to send logs and the second addresses the server that manages UFs configurations (in your test case is the same, usually are different servers). Then you could use the Splunk-TA_Windows to ingest Windows logs. Ciao. Giuseppe ... View more