Hello, I wanted to know where I should keep this attribute KV_MODE=json to extract the json fields automatically? In Deployment server or manager node or deployer? We have props.conf in a app in DS. DS push that app to manager node. And manager will distribute that app to peer nodes. Can I add this in that props.conf? Or any alternative please suggest. ... View more

We are currently using config explorer app to update configurations across our deployments  My doubt here is how can I run CLI command in config explorer? I need to give CLI command in Deployer to deploy apps across SH cluster members? We don't have backend server access as of now. Is it possible to run CLI command through config explorer or do we need to have backend server access for that for sure? ... View more

We have a deployment server which deploys apps (which contains configs) to Search head cluster (3 SH). I am not sure whether DS distributes apps directly to SH members or it will sent to deployer and from there deployer will distribute apps to SH members? Please clarify. We have created a role in DS app which restricts to specific index. When we try to push it... That role is not reflecting in SH members? But when we are checking in Deployer that app is present under shcluster/apps and that role is updated. But it is not showing in SH UI. What is the problem?   Do we need to manually push the config from deployer to SH members everytime? We have config in Deployer as deployer_push_mode=merge_to_default... Is it means distribution is automated? If not how to push config from Deployer to SH members through Splunk web? We don't have access to backend server to give CLI command. ... View more

Hello, let me explain my architecture. Multi site cluster (3 site cluster)... 2 indexers, 1 SH, 2 syslog servers (UF installed)... In each site 1 Dep server, 1 Deployer overall, 2 cluster managers (1 stand by)... As of now, network logs are configured to our syslog server and UF forward the data to indexers. We will configure logs with the help of FQDN.  For example we have X application which may or may not contain FQDN. If it contains FQDN, it will go to that app index or else it will go to different index. (Wrote these props and transforms in cluster manager). In deployment server inputs.conf we just given log path along with different index (which specified in transforms of Cluster manager). So all the logs will flow to cluster manager and then we wrote props and transforms to filter the data. Is there any other way to write these configurations other than this? Giving props and transforms of cluster manager: cat props.conf [f5_waf] TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 25 TIME_FORMAT = %b %d %H:%M:%S SEDCMD-newline_remove = s/\\r\\n/\n/g LINE_BREAKER = ([\r\n]+)[A-Z][a-z]{2}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}\s SHOULD_LINEMERGE = False TRUNCATE = 10000 # Leaving PUNCT enabled can impact indexing performance. Customers can # comment this line if they need to use PUNCT (e.g. security use cases) ANNOTATE_PUNCT = false TRANSFORMS-0_fix_hostname = syslog-host TRANSFORMS-1_extract_fqdn = f5_waf-extract_fqdn TRANSFORMS-2_fix_index = f5_waf-route_to_index   cat transforms.conf # FIELD EXTRACTION USING A REGEX [f5_waf-extract_fqdn] SOURCE_KEY = _raw REGEX = Host:\s(.+)\n FORMAT = fqdn::$1 WRITE_META = true # Routes the data to a different index-- This must be listed in a TRANSFORMS-<name> entry. [f5_waf-route_to_index] INGEST_EVAL = indexname=json_extract(lookup("fqdn_indexname_mapping.csv", json_object("fqdn", fqdn), json_array("indexname")), "indexname"), index=if(isnotnull(indexname), indexname, index), fqdn:=null(), indexname:=null()   cat fqdn_indexname_mapping.csv fqdn indexname selenium.systems.us.fed xxx_app_selenium1 v-testlab-service1.systems.us.fed xxx_app_testlab_service1   Gone through documents but just asking for any better alternatives??  ... View more

Hi all, We have specific AD group for specific application and we create index for that app and restrict access to that AD group (for all app users of that specific app) for that specific index. Generally they will be given FQDN/Hostname to us and we will be mapping to the particular index. In this way we have numerous AD groups and indexes. But our client is expecting less AD groups because it is difficult to maintain those many AD groups.  So, here my question... is there any chance to reduce AD groups by restricting specific to Source type rather than Index? So in one index can we have multiple applications where we can restrict them by sourcetype? If yes, please help me with the approach?   ... View more

My team has created production environment with 6 syslog servers (2 in each of 3 multi site cluster).  My question is do two syslog servers be active active or one active and one stand by? Which will be the good practice?  And do load balancer needs here for syslog servers? Currently some app teams are using UDP and some are TCP. basically these are network logs from network devices. Differences bw DNS load balancer and LTM load balancer? Which is best? Please suggest what will be the good practice to achieve this without any data loss?  From syslog servers we have UF installed on it and forward it to our indexer. ... View more

I am pretty new to Splunk and my project is also new. Can someone please explain the configurations given in our cluster manager. We have a syslog server which receives logs from F5 WAF devices and UF in syslog server forwards the data to our cluster manager. ... View more