Hi vincenteous, I believe that you will want to not directly forward the authentication events to Splunk itself, but instead setup a radius server to log the authentication events locally, and then use the splunk forwarder to input those events like any other file monitor input. In this way you don't have to worry about the shared secret key from the splunk perspective. Let me know if this works out 😄 ... View more

In the process of writing this question I found the answer in the transforms.conf spec: Use a comma-separated list to apply multiple transform stanzas to a single TRANSFORMS extraction. Splunk applies them in the list order. For example, this sequence ensures that the [yellow] transform stanza gets applied first, then [blue], and then [red]: [source::color_logs] TRANSFORMS-colorchange = yellow, blue, red So in summary, the transforms application order is the order that you list them in the props configuration directive. ... View more

Hi edrivera3, I expect that you will need to be root in order to install Splunk. However, you can have splunk run as another user (usually the user Splunk) by running $SPLUNKHOME/bin/splunk enable boot-start -user splunk You will then want to do a chown -r splunk:splunk on $SPLUNKHOME Keep in mind, if you don't run as root you can have issues with reading some files, so make sure this works for you, or if you can adjust the permissions on the files (or the splunk user group membership) in order to get the inputs you need. Let me know if this helps! ... View more

Hi s0rbeto, you'll have at least one version of deploymentclient.conf in place, because that is where the config is kept that allows the forwarder to connect to the deployment server. The starting place would be to see what is currently being set for clientName. You could check the "forwarder management" section on the Deployment Server. It will list all the client there, along with their hostname and clientName. If the clientName is being defined in $SPLUNKHOME/etc/system/local/deploymentclient.conf, then you will have to take some more steps to be able to get out from under that. If it is being defined in an app ($SPLUNKHOME/etc/apps/someapp), then you could take advantage of Splunk configuration precedence and push out a new app by serverclass that is called something like ZZ_webservers-dc1, and ZZ_appservers-dc2 and the like. Each app will have a distinct clientName as granular as you want to get it. clientName = server1-db-vlan30-id123-ip192.168.1.1 would give you great options for crafting whitelists and blacklists to define serverclasses. Let me know how this works out 😄 ... View more

Hi OldManEd, my expectation is that S.o.S. runs a job at some point to populate that lookup with forwarders it has found. It might be that this is a single instance without any forwarders, and so it has nothing to populate that lookup with. If you do have forwarders sending in data, you could start to trace the config for any other mentions of this lookup. Go to $SPLUNKHOME/etc and run: grep -i splunk_forwarders_cache ./*/*/* for instance, or similar strings such as that to find other clues. ... View more

Hi Nathanpyun, There is a list of valid key names in the "Create advanced filters with 'whitelist' and 'blacklist'" section in this page : http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/MonitorWindowsdata It doesn't look like Account_Name is a valid key, and so I suspect that might be your issue. The "User" key might be what you are looking for. Please let me know if that helps! ... View more