Hi All, We are planning to upgrade Splunk search head which is currently running with the version 6.0.3 and ours is a distributed environment. Total number of search heads is four, out of which two are configured with 6.0.3 and other two with 6.2.1 (Enterprise Security and PCI). Shared search head pooling are used. All the search head/shared head pooling are configured in Linux (VM) Environment on premises. So kindly let me know the exact steps/documents on how to upgrade the search head with shared search head pooling. Note: We are going to upgrade only the search head initially then the rest of the components. ... View more

Hi All, Currently we are not getting the Symantec data into Splunk? Here is the process for sending logs from SEP to Splunk: Host machine (Symantec Servers) forward logs to splunkxxx.com via UDP/514. splunkthis.xxx.com load balances to Splunk heavy forwarders (splunkh01 and splunkh02) The logs are stored on each heavy forwarder under this path /opt/syslogs/symantec/SymantecServer/SEP01/SEP01.log --> Source file where splunk monitors the data and currently there is no data Configuration details - Heavy Forwarder inputs.conf stanza : [monitor:///opt/syslogs/symantec/SymantecServer/...] whitelist = .log index = sec_sym_av sourcetype = sep host_segment = 5 HF outputs.conf stanza : [tcpout] indexAndForward = false forwardedindex.filter.disable = true forceTimebasedAutoLB = true syslog-ng.conf details ( Only partial details are shared ) INPUTS source s_net { tcp( max-connections(1024) so_keepalive(yes) ); udp(); }; FILTERS filter f_syn_vm { host("sep*" type(glob) flags(ignore-case) ); }; filter f_syn_ee_vm { host("semp*" type(glob) flags(ignore-case) ); }; filter f_syn_ee_grm { host("gmsemp*" type(glob) flags(ignore-case) ); }; COMBINATION FILTERS filter f_syn { filter(f_syn_dc) or filter(f_syn_vm) or filter(f_syn_gen) or filter(f_syn_ee_gm) or filter(f_syn_ee_vm); }; DESTINATIONS WHEN 3.5 is available use: file("/opt/syslogs/$(lowercase "${HOST}")/$(lowercase "${PROGRAM.log})""); destination d_symdlp { file("/opt/syslogs/symantec/${HOST}/${PROGRAM}.log"); }; destination d_syn { file("/opt/syslogs/symantec/${HOST}/${PROGRAM}/${PROGRAM}.log"); }; log { source(s_net); filter(f_syn); destination(d_syn); }; log { source(s_net); filter(f_sym_dlp); destination(d_symdlp); }; When searched using the below query, got no result found and at same time there is no error found in the splunkd.log index = sec_sym_av* sourcetype = sep* host= host=sep01* Note - We are able to ping and retrieve system related information when we queried with the host name = and index= win_srv for the same server. index = win_svrs* host=sep01* Kindly guide us in fixing this issue as we need to get the Symantec data report. thanks in advance ... View more