We don’t required these serve to forward the logs to Splunk ... my confirmation is working Splunk stop collecting the logs after making them blacklist but it some time to initiate configuration I believe... ... View more

When you set the inputs and hit submit, the URL in your browser changes, with the parameters you set in the inputs. You should be able to bookmark that simply in your browser. An alternative would be to set that particular common selection as the default selection of that input. ... View more

Not sure if I get your question correct, but yes, I do believe you need to set that max_content_lenght on the indexers. It is the indexers that are rejecting the oversized bundle coming from the Search Heads. You might also want to double check using btool, that those settings are taken correctly. ... View more

What does your inputs.conf look like on the UF? Is this about the windows event logs, or some other data you're trying to ingest? ... View more

Many thanks ... View more

Basically 2 main options: The recommended approach for sending syslog to Splunk is to set up a server with a syslog daemon (rsyslog / syslog-ng) that receives the syslog data and writes it to file. Then install a Universal Forwarder on that same server to read those files and send it to your indexer(s). The advantage of this is, that the syslog feed is not interrupted when you need to stop / restart splunk (e.g. for maintenance / upgrade of the UF / deploying new inputs). Also the way a syslog daemon can nicely generate dynamic files (e.g. one file per hour per source host) makes it easier to process the data in splunk (e.g. take hostname from path) and troubleshoot in case of issues with the feed. A somewhat simpler, less robust, option is to set up a TCP or UDP input directly in Splunk and point Venafi to send syslog to that port. ... View more

Happy to helped you! Ciao and Next Time! Giuseppe ... View more

As was said above, it was a problem with my partitions. I resized the partition and it now works perfectly ... View more

Hi FrankVI, It worked thanks. ... View more

That could be. On windows I know that is indeed the case, on linux there are various installer options, while many people also just manually unpack and deploy the tgz archive. I guess that is why the docs choose the better safe than sorry option and recommend to stop splunk before installing, so there is no dependency on the particular installer being used. Also, it is good to realize that even if the installer does it for you, the install does involve stopping and starting splunk. ... View more

It worked.. Thanks ... View more

Awesome! For newbies like me, if it doesn't work, finding the problem can be really problematic. So really good to ensure the examples work. Thanks again ... View more

thanks for the different options and on the _TCP_ROUTING bit link. ... View more

You have GOT to be kidding me! Please give us more details. There are several Tenable apps on splunk base; which one (please give URL) and which version? Which lines did you comment out. Please add this detail to this answer then click Accept to close it so we can all avoid/fix this problem in our environments! ... View more

Just add this to the bottom of your existing search: ... | eval PROC_NAME = "PROC_NAME_" . PROC_NAME | eval {PROC_NAME} = PROC_VALUE | eval _time = strptime(TIMESTAMP, "%Y-%m-%d %H:%M:%S") | timechart min(PROC_NAME_*) AS min_* max(PROC_NAME_*) AS max_* avg(PROC_NAME_*) AS avg_* Here is a run-anywhere PoC: | makeresults | eval raw="TIMESTAMP=2019-07-14T08:48:20,SID=DEV,SYS_NAME=ALL,PROC_TYPE=KPI,PROC_PARA=ALL,PROC_CODE=10110,PROC_NAME=Number_of_App_Servers,PROC_VALUE=2 TIMESTAMP=2019-07-14T08:48:20,SID=DEV,SYS_NAME=sapbcsdev_DEV_00,PROC_TYPE=INFO,PROC_PARA=INSTANCE,PROC_CODE=10010,PROC_NAME=INSTANCE_START_DATE,PROC_VALUE=20190712 TIMESTAMP=2019-07-14T08:48:20,SID=DEV,SYS_NAME=sapbcsdev_DEV_00,PROC_TYPE=INFO,PROC_PARA=INSTANCE,PROC_CODE=10020,PROC_NAME=INSTANCE_START_TIME,PROC_VALUE=125853 TIMESTAMP=2019-07-14T08:48:20,SID=DEV,SYS_NAME=sapbcsdev_DEV_00,PROC_TYPE=KPI,PROC_PARA=INSTANCE,PROC_CODE=10030,PROC_NAME=Workprocess_Dia_Active_Count,PROC_VALUE=9 TIMESTAMP=2019-07-14T08:48:20,SID=DEV,SYS_NAME=sapbcsdev_DEV_00,PROC_TYPE=KPI,PROC_PARA=INSTANCE,PROC_CODE=10040,PROC_NAME=Workprocess_Upd_Active_Count,PROC_VALUE=1" | makemv raw | mvexpand raw | rename raw AS _raw | kv | rex field=TIMESTAMP mode=sed "s/T/ /" | eval PROC_NAME = "PROC_NAME_" . PROC_NAME | eval {PROC_NAME} = PROC_VALUE | eval _time = strptime(TIMESTAMP, "%Y-%m-%d %H:%M:%S") | timechart min(PROC_NAME_*) AS min_* max(PROC_NAME_*) AS max_* avg(PROC_NAME_*) AS avg_* ... View more

your a star! ... View more

Nice 🙂 I've converted my comment to an answer. ... View more

I checked one file and details are- Created-Today, ‎July ‎11, ‎2019, ‏‎11 hours ago Modified-Yesterday, ‎July ‎10, ‎2019, ‏‎2:22:52 AM isn't it strange that modified is 10 July and Created is 11 July? ... View more

Holy crap, I actually looked in the wrong documentation. I must have been blind. Thank you. ... View more

Then have a look at the second part of my answer. And I think you can keep the [source::tcp:516] as you had it initially. ... View more

Is that > supposed to be there? Why? ... View more

Thx for the various breakdowns ... View more

Thanks. This also works. ... View more