Sorry I know nothing of that service or C#. I pinged the HEC team that this thread exists. Not sure if one of them can look and have any ideas. ... View more

Splunk by default uses self signed certs. That is why you have to not validate to work. You would have to use the ca certificate chain for that default cert, replace with your own certs or leave validation off. I don't know if the light cloud uses same default certs as a stand alone. You can install local and look in $SPLUNK_HOME$/etc/auth ... View more

if you simply want to drop rows with either column having a null. you could do something like ... | where isnotnull(DomainA) AND isnotnull(DomainB) ... View more

== is equal. Similar is not the same statement. So, if the fields do not match exactly you will get no results. try a table http, http2 on the end and skim the results to see how they look compared to each other. ... View more

I don't have your example data but maybe try something like the following assuming you have the buildstate extracted into a field. ... | stats max(_time) as latestSeen by host, buildstate | xyseries host buildstate latestSeen | rename latestSeen:* as * You could then sort on the time. maybe do some math on the gap between the time values in the buildstate columns at the end. ... View more

And the deployer for the SHC cannot be a member, and the CM for the index cluster cannot be a member. Short answer is you need more systems. Depending on your data and search usage you are going to have tears from CPU, RAM and iOPS contention trying to subdivide just two physical machines. ... View more

You cannot edit certain things in ES via the GUI when in a search head cluster. You will have to add those things (e.g. new identity and asset list files) in the application configuration files on your SHC deployer and push the changes to your cluster. ... View more

You should output your ldap search to a csv lookup table then tell ES that is a new assets lookup table. It will then consume it on changes and keep the auto lookups that exist within ES populated and working. You can find the instructions on using asset tables and a macro to ensure they have gotten ingested at http://docs.splunk.com/Documentation/ES/4.6.0/User/AssetandIdentityLookupReference ... View more

If you don't want to rely on the Alexa file being available, Cisco Umbrella made a version in the same file format in response. You can find it at http://s3-us-west-1.amazonaws.com/umbrella-static/index.html Just disable the existing Alexa download entry in ES. Then do the following steps. Clone it Make the name like cisco_top_one_million_sites Leave the type as alexa Edit the description appropriately Paste the url as this link which is on the site linked above: http://s3-us-west-1.amazonaws.com/umbrella-static/top-1m.csv.zip Then save it and you have replaced it. ... View more

You can see my holiday Extreme Search series over on my blog. www.georgestarcher.com ... View more

If you are an ES customer or can get your rep to provide XS you can install it. There is no actual dependance from an install standpoint on ES. Many ES customers use it on other search heads once they have it via their ES license. ... View more

Index clustering does not ensure equal event counts from all indexers to a search. It ensures copies across the indexers in the event of a loss of an indexer. You get results from the primary buckets across indexers at the time. In your screen shot I imagine you have more active primary buckets on the one returning more results for that value of splunk_server. ... View more

You can try running btool and see if it lists your other token and what app it is coming from. splunk cmd btool --debug inputs list http ... View more

Did you make sure the user account had app level write permissions to the app context where the collection is stored? ... View more

If a user is deleted all it's private permission knowledge objects will get deleted too. I recommend an alerting app context. Have your alerting service account save all alerts there and with shared in app permissions. Once a knowledge object is shared beyond private it will NOT be deleted when the user account is. The account needs permissions to all indexes for the searches it will run. If it is going to use the Splunk encrypted password endpoint for any custom search commands etc then it also needs the Splunk capability "admin_all_objects" which is full admin/god level control of Splunk. You could let users make but not schedule searches. Then establish a "move to production" process where you copy or edit the meta data file owner of the knowledge object to your alert service account where you then schedule it. http://www.georgestarcher.com/splunk-alert-scripts-automating-control/ ... View more

Any of those methods will work fine at the scale of GB/day. Writing files at larger scales will run into normal universal forwarder issues such as ulimits, race conditions of reading large files before you log rotate them out of the UF observation etc. I am a fan of HTTP Event Collector (HEC) if you are already working in something like Python where your data is likely in a JSON payload format already. I have a simple threaded python class for it already. There customers with HEC up in the TB/day. http://blogs.splunk.com/2015/12/11/http-event-collect-a-python-class/ ... View more

Splunk counts anything that is indexed. If you are referencing downloaded threat data for Splunk Enterprise Security, that goes into KVstore and lookup tables which is not an index so it is not a license usage thing. ... View more

HEC configs are in $SPLUNK_HOME/etc/apps/splunk_httpinput Did you check that you turned HEC back on in the Global Settings button after reinstall? I believe you can create tokens and not have the option "on". ... View more

If you mean the keys such as password for SSL and others for clustering from inputs.conf and server.conf those are based on the $SPLUNK_HOME/etc/auth/splunk.secret. The Splunk instances need to all share that splunk.secret for the values to decrypt properly. If you did not have splunk.secret in place before starting Splunk the first time you could have to test to make sure you don't miss copying all possible files that are encrypted using it. I often will take splunk.secret from a cluster master and place it on cluster nodes before starting them the first time. This ensures all cluster members share the same secret and configs can just have the encrypted value in the files. ... View more

I also just updated the python code in the repo to add raw input support for Splunk v6.4+. ... View more

My colleague Matt Uebel gave a talk at .conf that covers this topic. His materials are in his git repo at https://github.com/MattUebel/splunk_UF_hardening ... View more

You can see example python code with batch mode: http://blogs.splunk.com/2015/12/11/http-event-collect-a-python-class/ ... View more