Your splunk config looks correct. According to that message, it seems that you're not getting a successful connection to the indexer at 172.16.1.1 port:9997. What this is typically indicative of is a firewall blocking connections. If the indexer is on Linux, I would check and see if iptables is running and if that port is allowed through. (service iptables status OR service iptables stop) If you're on windows, you need to check the server's firewall stats and config and config all inbound connections to TCP9997 are allowed. ... View more

Can you include your inputs on the indexer and outputs on the client? Additionally check the _internal index and see if there are any errors that stand out. ... View more

You can separate multivalues with a pipe as a delimter, per the documentation. However, the way ES hashes out the threatlists url values, it's probably most efficient to have multiple values broken out.. ... View more

The current Tripwire app can be installed and run on a SH that also has ES running on it. However, I think the actual question is if the Tripwire App (TA) will tag data correctly according to CIM so that it will be mapped into the correct security domains in Splunk Enterprise Security. In that later case, the answer is not fully. The Tripwire app is maintained by Tripwire and it is currently not CIM compatible. However, you can update the field mappings quite easily as the extractions are mostly done. ... View more

This is a partner supported app, meaning Palo Alto Networks support this app. Please contact them at btorres-gil@paloaltonetworks.com, and they can provide a bit more guidance, but I think you are on the right track. ... View more

What framework are you referring to? ... View more

Your dedup is removing all the duplicated sources if I understand this correctly. Why not use the host field for these sources? That will be unique... So do something similar as.. index=ABC sourcetype=host Logon | rex field=source "/opt\/(?P<Client>w+))\/" |stats count by host, Client Your host field will be unique to each event. You can extract the Client name from the path and then do a dedup or stats count on it.. That will give you a unique count of events by host and by Client (username/ path on disk..) ... View more

Have you performed the restart on all of the members and has a captain been succesfully nominated? ./splunk show shcluster-status from the members. ... View more

Java 8 still isnt supported in DBConnect, so downgrade to 1.7. I'd also check on your system and see which version of Java is active. You may need to install more the the JRE.. On centos, you can use the 'alternatives' command ala 'alternatives --config java' and it will let you choose which version of java the system will use. ... View more

Check your configurations for that index via btool- splunk btool indexes list myindexname --debug That will show you all configurations applied to that index. You might have some left over configuration in there. ... View more

Using an HF at the intermediate, you can select the role as indexer. Its important to note that the difference between the UF and HF is related to how in the HF, all data is passed through Parsing -> Merging -> Typing -> and Index Pipeline queues. Even though the HF doesnt index, it just passes on, these queues are still touched and metadata is added. So setting the intermediate's as a Indexer will allow you to monitor these queues. The only thing to be aware of is that the Indexing queues will be doing TCP Out, and not writing to disk. Metrics should still be useful for queue troubleshooting. ... View more

... | rex "API\s\:\sIO\sET\s\:\"(?<myvalue>\d+)ms\"" | table myvalue That will also capture based on the text match before, leading up to the quotes, capture in the quotes up to the ms label. ... View more

Use a multiline rex.. This will capture everything in the "..". search.... | rex field=_raw "^\[dto=forename\:\s\"(?<fname>.*)\"\nsurname\:\s\"(?<lastname>.*)\"" | table forename lastname Another option would be to use props, set your sourcetype with linemerge=false, and define your event boundaries. ... View more

I haven't used SED for rex, however it is full supported according to docs. .... | rex field=ccnumbers mode=sed "s/(\d{4}-){3}/XXXX-XXXX-XXXX-/g" That should work. ... View more

You can check this on each SH instance by looking at the Report Acceleration page. Go to Settings > Report Acceleration Summaries. http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Manageacceleratedsearchsummaries#Use_the_Report_Acceleration_Summaries_page ... View more

CSV's are not TCP inputs. CSV's are flat files that are read into Splunk from the file system and parsed differently because the header applies to the whole file, where as TCP inputs are sent over the network and processed per event and headers are not maintained. So this changes the whole process. If you try to read in a CSV file, the sourcetype will be different then a TCP input due to the nature of how the file and network flow look. I recommend creating a sourcetype for the CSV on disk first, and validate that based on the above recommendations. Once that is done and validated, move on to the network input based sourcetype. For that, share how the events look coming over the wire and we can help more. ... View more

For your sourcetype, you should be setting you delimiter in props for CSV.. props.conf [mycsvsourcetype] HEADER_FIELD_LINE_NUMBER=1 TIMESTAMP_FIELDS=date FIELD_DELIMITER=, Your sources need to be consistent in terms of the header existing. Once indexed correctly, you can search for fields as desired: sourcetype=mycsvsourcetype Color=red | table Color, Data1,Data2 That will return all events with the field named Color, that has the value of red. Do note, field names are case sensitive. So if your header is "Color" and "Data1", you have to use those fields names. ... View more

Try removing all SH and distributed search configuration. Then rejoining the SH to the cluster. Sounds like you have a configuration that is still left in there somewhere. ... View more

No.. just the indexers. ... View more

You should be adding your search heads to the cluster master, and not individual search peers. I would remove them from the cluster, remove / disable any distributed search configuration, and then rejoin them to the cluster and see if that resolves the issue. ... View more

Does your cluster master report the cluster's search factor and replication factor as being met? Does it show the indexes with data in them, and buckets as having been replicated? ... View more

If the splunk instance is back up and running, run a search for "index=_internal" from the time range it crashed and start looking for events. ... View more