hi，Please forgive my English In my indexer cluster,The Chinese in the event shows that there is a coding problem, showing something like hexadecimal. \x3A\xAB I tried to set the sourcetype encoding on the index master node. Set up as follows: vim /opt/splunk/etc/master-apps/_cluster/local/props.conf [Firewall] CHARSET = AUTO Then distribute the bundle. And did not play any effect I have also tried to adapt to the Chinese code: [Firewall] CHARSET = HZ But it still does not have any effect Why? Is my method wrong? ... View more

hello~ everyone I have a search head cluster,It has the following members: two search heads, a search captain, and a deployer. How do I install APP in a search cluster? Is the way to distribute bundles to install APP? Is there a relevant documentation guide? ... View more

there are many hosts in an indexer. How do I check if the log is missing? If a host does not have a log Within an hour, I think it's a log loss If a host log is lost, I need to find it and remind me. How does the SPL statement write? ... View more

I have an indexer cluster with 8 indexers and a master node. Now, I need to remove an index data, the index name is "tomcat" How to quickly remove index data from an indexer cluster? distribute bundle? only one by one delete indexs data from each indexer?？ ... View more

I have a separate Splunk Enterprise instance, The 9997 port has been enabled to receive events from each host and set up their own index for them。For example: apache_access, secure ect ..... now , I want to convert it into a heavy forwarder and forwards these events to an indexer cluster. So the question is coming， How do I forward the event of a specific index on the heavy forwarder, （for example: apache_access） to the specified index of the indexer cluster (for example: web_apache_access) Example: apache_access (from heavy-forwarder) ————————>Forward TO ————>web_apache_access（indexer clustering） ... View more

Sorry, my English is not very good. I extracted a field named "user-agent", I also have a CSV file, the specific content is as follows: Now,I want to use the lookup function for fuzzy matching with user-agent results. Can I do it? for example : user-agent=Mozilla/5.0 (Windows NT 6.2; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0 How to fuzzy match the contents of a column in a CSV file. I expect the output of the second, three column with the result You might suggest that I use the eval function, But I have a lot of keywords But I have a lot of keywords ... View more

This is a problem that occurs on the cluster I have a index is "apache_access"，It mainly collects apache access information. Its events come from multiple hosts of the apache log. so their sourcetype is not the same, now ,There are now 5 sourcetype Now 。I'm going to extract the fields of the apache access log, which requires me to choose a source type. But there is only one source type, and other source types are not shown。 If i chose this sourcetype, then I extracted the field can only be applied to this sourcetype question: How can I extract a field that can be applied to all sourcetype on the apache_access index ... View more

This is the Linux system's secure log（/var/log/secure）。I tried to crack the user and password to login SSH . now,I extracted two fields, one is the login_IP, one is the login_name. SPL search on Splunk Enterprise : index=test Failed password for |transantion maxpause=2s maxspan=10s|where eventcount>=9|table login_name,login_IP I think my method is not perfect, Then do you have a better way to monitor violence crack against Linux login May 15 16:04:38 localhost sshd[5514]: Failed password for root from 192.168.240.143 port 49790 ssh2 May 15 16:04:38 localhost sshd[5517]: Failed password for root from 192.168.240.143 port 49796 ssh2 May 15 16:04:38 localhost sshd[5519]: Failed password for root from 192.168.240.143 port 49800 ssh2 May 15 16:04:38 localhost sshd[5516]: Failed password for root from 192.168.240.143 port 49794 ssh2 May 15 16:04:38 localhost sshd[5513]: Failed password for root from 192.168.240.143 port 49786 ssh2 May 15 16:04:38 localhost sshd[5520]: Failed password for root from 192.168.240.143 port 49802 ssh2 May 15 16:04:38 localhost sshd[5521]: Failed password for root from 192.168.240.143 port 49804 ssh2 May 15 16:04:38 localhost sshd[5512]: Failed password for root from 192.168.240.143 port 49788 ssh2 May 15 16:04:38 localhost sshd[5515]: Failed password for root from 192.168.240.143 port 49792 ssh2 May 15 16:04:38 localhost sshd[5518]: Failed password for root from 192.168.240.143 port 49798 ssh2 May 15 16:04:53 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2 May 15 16:04:53 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2 May 15 16:04:53 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2 May 15 16:04:53 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2 May 15 16:04:53 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2 May 15 16:04:53 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2 May 15 16:04:53 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2 May 15 16:04:53 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2 May 15 16:04:53 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2 May 15 16:04:53 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2 May 15 16:04:55 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2 May 15 16:04:55 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2 May 15 16:04:55 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2 May 15 16:04:55 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2 May 15 16:04:55 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2 May 15 16:04:55 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2 May 15 16:04:55 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2 May 15 16:04:55 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2 May 15 16:04:55 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2 May 15 16:04:55 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2 May 15 16:04:57 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2 May 15 16:04:57 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2 May 15 16:04:57 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2 May 15 16:04:57 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2 May 15 16:04:57 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2 May 15 16:04:57 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2 May 15 16:04:57 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2 May 15 16:04:57 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2 May 15 16:04:57 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2 May 15 16:04:57 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2 May 15 16:04:59 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2 May 15 16:04:59 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2 May 15 16:04:59 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2 May 15 16:04:59 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2 May 15 16:04:59 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2 May 15 16:04:59 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2 May 15 16:04:59 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2 May 15 16:04:59 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2 May 15 16:04:59 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2 May 15 16:04:59 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2 May 15 16:05:01 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2 May 15 16:05:01 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2 May 15 16:05:01 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2 May 15 16:05:01 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2 May 15 16:05:01 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2 May 15 16:05:01 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2 May 15 16:05:01 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2 May 15 16:05:01 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2 May 15 16:05:01 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2 May 15 16:05:01 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2 May 15 16:05:03 localhost sshd[5552]: Failed password for root from 192.168.240.143 port 50326 ssh2 May 15 16:05:03 localhost sshd[5544]: Failed password for root from 192.168.240.143 port 50310 ssh2 May 15 16:05:03 localhost sshd[5550]: Failed password for root from 192.168.240.143 port 50322 ssh2 May 15 16:05:03 localhost sshd[5546]: Failed password for root from 192.168.240.143 port 50314 ssh2 May 15 16:05:03 localhost sshd[5548]: Failed password for root from 192.168.240.143 port 50318 ssh2 May 15 16:05:03 localhost sshd[5547]: Failed password for root from 192.168.240.143 port 50316 ssh2 May 15 16:05:03 localhost sshd[5551]: Failed password for root from 192.168.240.143 port 50324 ssh2 May 15 16:05:03 localhost sshd[5549]: Failed password for root from 192.168.240.143 port 50320 ssh2 May 15 16:05:03 localhost sshd[5545]: Failed password for root from 192.168.240.143 port 50312 ssh2 May 15 16:05:04 localhost sshd[5553]: Failed password for root from 192.168.240.143 port 50328 ssh2 May 15 16:05:06 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2 May 15 16:05:06 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2 May 15 16:05:06 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2 May 15 16:05:06 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2 May 15 16:05:06 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2 May 15 16:05:07 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2 May 15 16:05:08 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2 May 15 16:05:08 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2 May 15 16:05:08 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2 May 15 16:05:08 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2 May 15 16:05:08 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2 May 15 16:05:09 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2 May 15 16:05:10 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2 May 15 16:05:10 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2 May 15 16:05:10 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2 May 15 16:05:10 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2 May 15 16:05:10 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2 May 15 16:05:10 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2 May 15 16:05:13 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2 May 15 16:05:13 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2 May 15 16:05:13 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2 May 15 16:05:13 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2 May 15 16:05:13 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2 May 15 16:05:13 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2 May 15 16:05:13 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2 May 15 16:05:13 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2 May 15 16:05:13 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2 May 15 16:05:13 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2 May 15 16:05:15 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2 May 15 16:05:15 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2 May 15 16:05:15 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2 May 15 16:05:15 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2 May 15 16:05:15 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2 May 15 16:05:15 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2 May 15 16:05:16 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2 May 15 16:05:16 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2 May 15 16:05:16 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2 May 15 16:05:16 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2 May 15 16:05:17 localhost sshd[5628]: Failed password for root from 192.168.240.143 port 51272 ssh2 May 15 16:05:17 localhost sshd[5629]: Failed password for root from 192.168.240.143 port 51274 ssh2 May 15 16:05:17 localhost sshd[5624]: Failed password for root from 192.168.240.143 port 51260 ssh2 May 15 16:05:17 localhost sshd[5631]: Failed password for root from 192.168.240.143 port 51278 ssh2 May 15 16:05:17 localhost sshd[5630]: Failed password for root from 192.168.240.143 port 51276 ssh2 May 15 16:05:17 localhost sshd[5625]: Failed password for root from 192.168.240.143 port 51270 ssh2 May 15 16:05:18 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2 May 15 16:05:18 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2 May 15 16:05:18 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2 May 15 16:05:18 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2 May 15 16:05:20 localhost sshd[5696]: Failed password for root from 192.168.240.143 port 52320 ssh2 May 15 16:05:20 localhost sshd[5697]: Failed password for root from 192.168.240.143 port 52322 ssh2 May 15 16:05:20 localhost sshd[5692]: Failed password for root from 192.168.240.143 port 52312 ssh2 May 15 16:05:20 localhost sshd[5695]: Failed password for root from 192.168.240.143 port 52318 ssh2 May 15 16:05:20 localhost sshd[5694]: Failed password for root from 192.168.240.143 port 52316 ssh2 May 15 16:05:20 localhost sshd[5698]: Failed password for root from 192.168.240.143 port 52324 ssh2 May 15 16:05:20 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2 May 15 16:05:20 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2 May 15 16:05:20 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2 May 15 16:05:20 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2 May 15 16:05:22 localhost sshd[5697]: Failed password for root from 192.168.240.143 port 52322 ssh2 May 15 16:05:22 localhost sshd[5696]: Failed password for root from 192.168.240.143 port 52320 ssh2 May 15 16:05:22 localhost sshd[5692]: Failed password for root from 192.168.240.143 port 52312 ssh2 May 15 16:05:22 localhost sshd[5694]: Failed password for root from 192.168.240.143 port 52316 ssh2 May 15 16:05:22 localhost sshd[5695]: Failed password for root from 192.168.240.143 port 52318 ssh2 May 15 16:05:22 localhost sshd[5698]: Failed password for root from 192.168.240.143 port 52324 ssh2 May 15 16:05:22 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2 May 15 16:05:22 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2 May 15 16:05:22 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2 May 15 16:05:23 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2 May 15 16:05:24 localhost sshd[5697]: Failed password for root from 192.168.240.143 port 52322 ssh2 May 15 16:05:24 localhost sshd[5692]: Failed password for root from 192.168.240.143 port 52312 ssh2 May 15 16:05:24 localhost sshd[5696]: Failed password for root from 192.168.240.143 port 52320 ssh2 May 15 16:05:24 localhost sshd[5698]: Failed password for root from 192.168.240.143 port 52324 ssh2 May 15 16:05:24 localhost sshd[5695]: Failed password for root from 192.168.240.143 port 52318 ssh2 May 15 16:05:24 localhost sshd[5694]: Failed password for root from 192.168.240.143 port 52316 ssh2 May 15 16:05:25 localhost sshd[5661]: Failed password for root from 192.168.240.143 port 51282 ssh2 May 15 16:05:25 localhost sshd[5664]: Failed password for root from 192.168.240.143 port 51286 ssh2 May 15 16:05:25 localhost sshd[5662]: Failed password for root from 192.168.240.143 port 51284 ssh2 May 15 16:05:25 localhost sshd[5660]: Failed password for root from 192.168.240.143 port 51280 ssh2 May 15 16:05:26 localhost sshd[5697]: Failed password for root from 192.168.240.143 port 52322 ssh2 May 15 16:05:26 localhost sshd[5692]: Failed password for root from 192.168.240.143 port 52312 ssh2 May 15 16:05:26 localhost sshd[5698]: Failed password for root from 192.168.240.143 port 52324 ssh2 May 15 16:05:26 localhost sshd[5695]: Failed password for root from 192.168.240.143 port 52318 ssh2 May 15 16:05:26 localhost sshd[5696]: Failed password for root from 192.168.240.143 port 52320 ssh2 May 15 16:05:27 localhost sshd[5694]: Failed password for root from 192.168.240.143 port 52316 ssh2 May 15 16:05:28 localhost sshd[5742]: Failed password for root from 192.168.240.143 port 52330 ssh2 May 15 16:05:28 localhost sshd[5745]: Failed password for root from 192.168.240.143 port 52332 ssh2 May 15 16:05:28 localhost sshd[5740]: Failed password for root from 192.168.240.143 port 52326 ssh2 May 15 16:05:28 localhost sshd[5741]: Failed password for root from 192.168.240.143 port 52328 ssh2 May 15 16:05:28 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2 May 15 16:05:29 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2 May 15 16:05:29 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2 May 15 16:05:29 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2 May 15 16:05:29 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2 May 15 16:05:29 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2 May 15 16:05:30 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2 May 15 16:05:30 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2 May 15 16:05:30 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2 May 15 16:05:30 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2 May 15 16:05:30 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2 May 15 16:05:30 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2 May 15 16:05:30 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2 May 15 16:05:30 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2 May 15 16:05:30 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2 May 15 16:05:31 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2 May 15 16:05:32 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2 May 15 16:05:32 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2 May 15 16:05:32 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2 May 15 16:05:32 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2 May 15 16:05:32 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2 May 15 16:05:32 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2 May 15 16:05:32 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2 May 15 16:05:32 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2 May 15 16:05:32 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2 May 15 16:05:32 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2 May 15 16:05:35 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2 May 15 16:05:35 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2 May 15 16:05:35 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2 May 15 16:05:35 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2 May 15 16:05:35 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2 May 15 16:05:35 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2 May 15 16:05:35 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2 May 15 16:05:35 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2 May 15 16:05:35 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2 May 15 16:05:35 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2 May 15 16:05:37 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2 May 15 16:05:37 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2 May 15 16:05:37 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2 May 15 16:05:37 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2 May 15 16:05:37 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2 May 15 16:05:37 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2 May 15 16:05:37 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2 May 15 16:05:37 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2 May 15 16:05:37 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2 May 15 16:05:37 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2 May 15 16:05:39 localhost sshd[5754]: Failed password for mysql from 192.168.240.143 port 52374 ssh2 May 15 16:05:39 localhost sshd[5770]: Failed password for mysql from 192.168.240.143 port 52432 ssh2 May 15 16:05:39 localhost sshd[5758]: Failed password for mysql from 192.168.240.143 port 52380 ssh2 May 15 16:05:39 localhost sshd[5752]: Failed password for mysql from 192.168.240.143 port 52370 ssh2 May 15 16:05:39 localhost sshd[5759]: Failed password for mysql from 192.168.240.143 port 52382 ssh2 May 15 16:05:39 localhost sshd[5777]: Failed password for mysql from 192.168.240.143 port 52450 ssh2 May 15 16:05:39 localhost sshd[5774]: Failed password for mysql from 192.168.240.143 port 52440 ssh2 May 15 16:05:39 localhost sshd[5772]: Failed password for mysql from 192.168.240.143 port 52438 ssh2 May 15 16:05:39 localhost sshd[5757]: Failed password for mysql from 192.168.240.143 port 52378 ssh2 May 15 16:05:39 localhost sshd[5763]: Failed password for mysql from 192.168.240.143 port 52386 ssh2 May 15 16:05:41 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2 May 15 16:05:41 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2 May 15 16:05:42 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2 May 15 16:05:42 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2 May 15 16:05:42 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2 May 15 16:05:42 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2 May 15 16:05:42 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2 May 15 16:05:42 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2 May 15 16:05:42 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2 May 15 16:05:42 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2 May 15 16:05:43 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2 May 15 16:05:43 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2 May 15 16:05:43 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2 May 15 16:05:43 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2 May 15 16:05:43 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2 May 15 16:05:43 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2 May 15 16:05:43 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2 May 15 16:05:43 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2 May 15 16:05:43 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2 May 15 16:05:43 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2 May 15 16:05:45 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2 May 15 16:05:45 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2 May 15 16:05:45 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2 May 15 16:05:45 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2 May 15 16:05:45 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2 May 15 16:05:45 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2 May 15 16:05:45 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2 May 15 16:05:45 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2 May 15 16:05:45 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2 May 15 16:05:45 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2 May 15 16:05:47 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2 May 15 16:05:47 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2 May 15 16:05:47 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2 May 15 16:05:47 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2 May 15 16:05:47 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2 May 15 16:05:47 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2 May 15 16:05:47 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2 May 15 16:05:47 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2 May 15 16:05:47 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2 May 15 16:05:47 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2 May 15 16:05:49 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2 May 15 16:05:49 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2 May 15 16:05:49 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2 May 15 16:05:49 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2 May 15 16:05:49 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2 May 15 16:05:49 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2 May 15 16:05:49 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2 May 15 16:05:49 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2 May 15 16:05:49 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2 May 15 16:05:49 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2 May 15 16:05:51 localhost sshd[5834]: Failed password for invalid user test from 192.168.240.143 port 54612 ssh2 May 15 16:05:51 localhost sshd[5832]: Failed password for invalid user test from 192.168.240.143 port 54608 ssh2 May 15 16:05:51 localhost sshd[5836]: Failed password for invalid user test from 192.168.240.143 port 54616 ssh2 May 15 16:05:51 localhost sshd[5831]: Failed password for invalid user test from 192.168.240.143 port 54606 ssh2 May 15 16:05:51 localhost sshd[5838]: Failed password for invalid user test from 192.168.240.143 port 54620 ssh2 May 15 16:05:51 localhost sshd[5835]: Failed password for invalid user test from 192.168.240.143 port 54614 ssh2 May 15 16:05:51 localhost sshd[5833]: Failed password for invalid user test from 192.168.240.143 port 54610 ssh2 May 15 16:05:51 localhost sshd[5837]: Failed password for invalid user test from 192.168.240.143 port 54618 ssh2 May 15 16:05:51 localhost sshd[5847]: Failed password for invalid user test from 192.168.240.143 port 54622 ssh2 May 15 16:05:51 localhost sshd[5829]: Failed password for invalid user test from 192.168.240.143 port 54604 ssh2 May 15 16:05:53 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2 May 15 16:05:53 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2 May 15 16:05:53 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2 May 15 16:05:53 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2 May 15 16:05:53 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2 May 15 16:05:53 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2 May 15 16:05:54 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2 May 15 16:05:54 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2 May 15 16:05:54 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2 May 15 16:05:54 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2 May 15 16:05:55 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2 May 15 16:05:55 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2 May 15 16:05:56 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2 May 15 16:05:56 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2 May 15 16:05:56 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2 May 15 16:05:57 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2 May 15 16:05:57 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2 May 15 16:05:57 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2 May 15 16:05:58 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2 May 15 16:05:58 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2 May 15 16:05:58 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2 May 15 16:05:58 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2 May 15 16:05:58 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2 May 15 16:05:59 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2 May 15 16:06:01 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2 May 15 16:06:01 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2 May 15 16:06:01 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2 May 15 16:06:01 localhost sshd[5851]: Failed password for invalid user test from 192.168.240.143 port 55536 ssh2 May 15 16:06:01 localhost sshd[5853]: Failed password for invalid user test from 192.168.240.143 port 55540 ssh2 May 15 16:06:01 localhost sshd[5849]: Failed password for invalid user test from 192.168.240.143 port 55532 ssh2 May 15 16:06:01 localhost sshd[5862]: Failed password for invalid user test from 192.168.240.143 port 55546 ssh2 May 15 16:06:01 localhost sshd[5864]: Failed password for invalid user test from 192.168.240.143 port 55548 ssh2 May 15 16:06:01 localhost sshd[5865]: Failed password for invalid user test from 192.168.240.143 port 55550 ssh2 May 15 16:06:01 localhost sshd[5861]: Failed password for invalid user test from 192.168.240.143 port 55544 ssh2 May 15 16:06:03 localhost sshd[5852]: Failed password for invalid user test from 192.168.240.143 port 55538 ssh2 May 15 16:06:03 localhost sshd[5854]: Failed password for invalid user test from 192.168.240.143 port 55542 ssh2 May 15 16:06:03 localhost sshd[5850]: Failed password for invalid user test from 192.168.240.143 port 55530 ssh2 May 15 16:06:03 localhost sshd[5869]: Failed password for toor from 192.168.240.143 port 56516 ssh2 May 15 16:06:03 localhost sshd[5873]: Failed password for toor from 192.168.240.143 port 56530 ssh2 May 15 16:06:03 localhost sshd[5881]: Failed password for toor from 192.168.240.143 port 56650 ssh2 May 15 16:06:03 localhost sshd[5870]: Failed password for toor from 192.168.240.143 port 56522 ssh2 May 15 16:06:03 localhost sshd[5884]: Failed password for toor from 192.168.240.143 port 56652 ssh2 May 15 16:06:04 localhost sshd[5878]: Failed password for toor from 192.168.240.143 port 56616 ssh2 May 15 16:06:04 localhost sshd[5880]: Failed password for toor from 192.168.240.143 port 56644 ssh2 May 15 16:06:05 localhost sshd[5892]: Failed password for toor from 192.168.240.143 port 57188 ssh2 May 15 16:06:05 localhost sshd[5894]: Failed password for toor from 192.168.240.143 port 57190 ssh2 May 15 16:06:05 localhost sshd[5890]: Failed password for toor from 192.168.240.143 port 57180 ssh2 May 15 16:06:05 localhost sshd[5878]: Failed password for toor from 192.168.240.143 port 56616 ssh2 May 15 16:06:05 localhost sshd[5881]: Failed password for toor from 192.168.240.143 port 56650 ssh2 May 15 16:06:05 localhost sshd[5884]: Failed password for toor from 192.168.240.143 port 56652 ssh2 May 15 16:06:05 localhost sshd[5870]: Failed password for toor from 192.168.240.143 port 56522 ssh2 May 15 16:06:05 localhost sshd[5869]: Failed password for toor from 192.168.240.143 port 56516 ssh2 May 15 16:06:05 localhost sshd[5880]: Failed password for toor from 192.168.240.143 port 56644 ssh2 May 15 16:06:05 localhost sshd[5873]: Failed password for toor from 192.168.240.143 port 56530 ssh2 May 15 16:06:07 localhost sshd[5892]: Failed password for toor from 192.168.240.143 port 57188 ssh2 May 15 16:06:07 localhost sshd[5890]: Failed password for toor from 192.168.240.143 port 57180 ssh2 May 15 16:06:07 localhost sshd[5894]: Failed password for toor from 192.168.240.143 port 57190 ssh2 May 15 16:06:07 localhost sshd[5878]: Failed password for toor from 192.168.240.143 port 56616 ssh2 May 15 16:06:07 localhost sshd[5881]: Failed password for toor from 192.168.240.143 port 56650 ssh2 May 15 16:06:07 localhost sshd[5884]: Failed password for toor from 192.168.240.143 port 56652 ssh2 May 15 16:06:07 localhost sshd[5873]: Failed password for toor from 192.168.240.143 port 56530 ssh2 May 15 16:06:07 localhost sshd[5870]: Failed password for toor from 192.168.240.143 port 56522 ssh2 May 15 16:06:07 localhost sshd[5869]: Failed password for toor from 192.168.240.143 port 56516 ssh2 May 15 16:06:07 localhost sshd[5880]: Failed password for toor from 192.168.240.143 port 56644 ssh2 May 15 16:06:09 localhost sshd[5894]: Failed password for toor from 192.168.240.143 port 57190 ssh2 ... View more

1、"Index" is my master node, why does it appear on my search head list? I try to type "splunk remove shcluster-member" on the index master node, it prompts the following information: 2、My original index cluster has three indexers. The set replication factor is: 3. The search factor is 2. Now I have added an indexer to the index cluster. Question: Why does the new indexer's default index have data, and other custom indexes do not have data? Should my copy factor be changed to "4"? ... View more