Since the MC comes with core Splunk, it just gets installed (if you are installing splunk in /opt/splunk, then MC will appear in /opt/splunk/etc/apps.), you just enable/configure under UI->settings->Monitoring Console. Follow the below link to configure MC and understand the right instance to configure it. https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/Configureindistributedmode ... View more

Check the documentation for the "mode" setting in the inputs.conf, in the past changing to "online" mode helped a bit. Also check the no-resolve as this takes up the cycles, you don't want to resolve the objects. https://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Setup2 It also depends on the number of checkpoint managers/connections you are handling on one forwarder. When it gets to millions of events from 50 different connections on forwarder can really get overloaded and you might need to look into distributing the load. This is just one of the scenario I have seen, but the yours might be different. ... View more

shivamchopra, You can always check the splunk logs on the universal forwarder to see if it has watch on that path or if it is actually complaining to read the path. Make sure you have some events in the log files you are reading. You mentioned sending to the HF first, make sure it is not indexing locally and in fact forwarding them across. sometimes we miss the obvious, check if the forwarder is in fact talking to the indexer, check the _internal index for that forwarder host. ... View more

Unless you make any changes to the TA/app you download from splunkbase or you add some customizations, you don't need a local directory. From the problem you explained, I believe you are looking into the dashboards in the security suite app - https://splunkbase.splunk.com/app/525/. If you check the default/eventtypes.conf - you will see the eventtype "cisco-firewall". Since you are getting the events with the source type "syslog", You can download the TA for cisco- ASA here. https://splunkbase.splunk.com/app/1620/. This one transforms your source type into cisco:asa which the app is looking for. ... View more

|inputlookup ip_lookup | search (whatever you want to search) ... View more

isitnikov, |inputlookup ip_lookup - is to just display what's in that lookup If you need to further search for the events that match any of these IPs - then you would need to further add the search |inputlookup ip_lookup | search ... View more

How does your props and transforms look? ... View more

Timestamp columns in the table might give an idea what they are..Might be good idea to check with the data owner..Sometimes SMEs of the data might give you better understanding what every field is in the DB. Even if you select one of your time stamp columns as the _time, you will still be able to report on all the other timestamps as well.Mostly you might want the timestamp column when the event/incident first happened/created. ... View more

harishnpandey, Did you mean to post the actual sample event? ... View more

raghu0463 It is easy to identify if the forwarder connected to the Deployment server or not. follow the below steps, assuming you have the deployment server configured in your environment. 1. You did see deploymentclient.conf under system/local on the forwarder, Do you see the forwarder pointed to the right deployment server? another place to check for the deploymentclient.conf is $SPLUNK_HOME/etc/apps on the forwarder 2. Grab the IP or the hostname of the forwarder, login to the deployment server UI->settings->forwarder management->under clients tab-> try to search for the IP or the hostname of the forwarder 3. If you don't see the expected details from the above steps, first you need to fix the connectivity between the deployment server and the forwarder 4. If you have the deployment server in the environment, best practice is to always deploy the configurations from the deployment server. Place to edit the configurations on the deployment server is $SPLUNK_HOME/etc/deployment-apps. Edit or create your outputs.conf in an app under deployment-apps and configure the server classes appropriately. 5. Now run the command "$SPLUNK_HOME/bin/splunk reload deploy-server" on the deployment server and you should see the configurations deployed under $SPLUNK_HOME/etc/apps on the forwarders ... View more

It is easy to test if that forwarder connected to the deployment server already or not. Follow these steps, assuming you did configured the deployment server in your environment. You did see deploymentclient.conf under system/local on the forwarder - what is in there? verify it is infact talking to the deployment server. If you don't see much details under system/local, then the next bet would be etc/apps - you might have an app for the deploymentclient.conf Grab the IP or the hostname of the forwarder and login to the deployment server->settings->forwarder management->under clients tab->search for the IP or the hostname of the UF - this will show up the details for the UF if it was talking to the Deployment server If you don't see the expected details in the above steps, you should probably fix the connectivity between the Deployment server and UF as the first step Once you have deployment server configured in your environment, it is a best practice you deploy all the configurations from there. Place to find/edit those configurations on the deployment server is $SPLUNK_HOME/etc/deployment-apps and make sure you have the right serverclass.conf configured. Edit the output.conf on the Deployment server ($SPLUNK_HOME/etc/deployment-apps) and then run the "reload" command and you should see configurations on the connected forwarders under $SPLUNK_HOME/etc/apps ... View more

Hi sfatnass,can you share your email-id, I can send you what I am working on, so can share examples? you can reach me at bheemireddi@gmail.com ... View more

sfatnass: was the solution work for you? I am trying for the similar requirement and when I try to use the function td.addClass('icon'), I get the checkbox icon, but that is static, not a clickable one. Wondering if you had it working and if so can you share the details on how you got it working? ... View more

Looks like I only have limited events populated with the values and rest blanks. and I was moving fast between sort asc/desc. Tried to run more specific queries with the where condition and saw some values populated. Thanks everyone for your comments and quick replies. ... View more

Hi, Yes I am aware that we need to configure the deployment client through either CLI or the deploymentclient.conf. Documentation says the default phoneHomeIntervalInSecs is 60Sec. So I was just referring where it was set. Thank you for all your replies. Raji. ... View more

Hi, I have gone through S.o.S app recently and I found the below link is very helpful. http://answers.splunk.com/answers/38091/best-practices-to-deploy-the-s-o-s-app-in-a-distributed-search-environment.html Once installed you need to enable the inputs on both Indexers and Search Heads. Thanks, Raji. ... View more

Hi Martin, Thanks for clarification. I do see those apps names in the URLs, but I still had a question, when I add inputs in the GUI, (I was changing the sourcetype, creating new sourcetype), I see the props.conf created under system/local and inputs.conf created under search (I was in search app). Wondering why props.conf created in global? Thanks for your response. ... View more