Hi All, Currently we got a request to adjust the time zone based on the Plant location from where the firewall logs are being sent to the splunk Heavy Forwarder instances and then get indexed in the individual indexer instances. Likewise in our environment HF instances act as the syslog servers. Exact requirement: Want to adjust the time zone based on the Plant location. Currently we could see all the data's are indexed with EDT time zone. There 13 different plant location from where the firewall logs are sent and mostly they all fall under these time Zone EST and CST, except for one plant located in Malaysia GMT -7. Below configuration details are set in customized app called Test-IA-guard and Test-TA-guard and both this app are placed in HF instances. Test-IA-guard are configured with inputs.conf stanza. [monitor:///opt/syslogs/guard/.../guard.log*] index=firewall sourcetype=guard:network:firewall host_segment = 4 Note : Props.conf and transforms.conf are configured based on setting per-event Host name. We have more than 200 nodes configured base on per-event Host name. Test-TA-mguard configured with props & transforms. Props.conf details : [host::10.X.X.X] TRANSFORMS-guard_rename = guard_rename_Host1 Transforms.conf details: [guard_rename_Host1] REGEX = . DEST_KEY = MetaData:Host FORMAT = host::guard-Line1 And we know that we can configure the timezone in props.conf using the TZ stanza either with sourcetype, host and source. But not sure how to configure time zone for 13 different location using same props.conf stanza. Kindly guide me how to configure the timezone based on different location. thanks in advance. ... View more

Hi All Currently we are facing an issue in retrieving the password from the app file and we are getting the below error in /opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log Error Details: TA-QualysCloudPlatform: 2017-10-18T00:10:46Z PID=20224 [MainThread] ERROR: TA-QualysCloudPlatform - Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/TA-QualysCloudPlatform/admin/passwords: [Errno 111] Connection refused',) TA-QualysCloudPlatform: 2017-10-18T00:11:46Z PID=20229 [MainThread] ERROR: TA-QualysCloudPlatform - Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/TA-QualysCloudPlatform/admin/passwords: [Errno 111] Connection refused',) TA-QualysCloudPlatform: 2017-10-19T14:09:40Z PID=64521 [MainThread] ERROR: TA-QualysCloudPlatform - Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/TA-QualysCloudPlatform/admin/passwords: [Errno 111] Connection refused',) TA-QualysCloudPlatform: 2017-10-19T14:10:39Z PID=64533 [MainThread] ERROR: TA-QualysCloudPlatform - Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: Splunkd daemon is not responding: ('Error connecting to /servicesNS/nobody/TA-QualysCloudPlatform/admin/passwords: [Errno 111] Connection refused',) TA-QualysCloudPlatform: 2017-10-20T01:40:56Z PID=12944 [MainThread] ERROR: TA-QualysCloudPlatform - Error during request to /msp/about.php, [None] Tunnel connection failed: 503 Service Unavailable. Qualys add-on version : 1.1.0.20161024 Add-on is installed in the Heavy forwarder instance and search head cluster members. Kindly guide me how to fix this issue. ... View more

Hi All, I need to customize the splunk Add-on for F5 BIG-IP based on the data ingested into splunk. F5 LTM data are being ingested into splunk Environment from syslogs servers. We have 5 Heavy forwarder instances configured to fetch this syslogs data's and forwards it to the 5 individual indexer instances. Splunk F5 Add-on is uploaded in search head cluster master and we want to customize the Technology add on, based on the data available in splunk from F5. Currently we could see the F5 data being ingested into splunk from 17 hosts and could see some 104 fields under interesting field details. Below is the inputs.conf detail. inputs.conf detail: F5 LTM [monitor:///opt/syslogs/web_access/.../*.log] index = web_app sourcetype = f5:network:loadbalancer host_segment = 4 From the splunk Add-on for F5 BIG-IP, I could see the below details: Appserver -- Not sure what is the purpose of it and whether we need to use this for our data. Default folder contains following Technology add on configuration file like props.conf, transforms.conf,web.conf, eventtypes.conf, tags.conf and these configuration files contains lots of predefined information but not sure how/where to start of with customization. Kindly guide me on how to customize the Add-on app based on F5 LTM data available in splunk. ... View more