israelzapata, My "solution" was to set up an RSyslog server on the server with the Heavy Forwarder that output to files and then I use the HF to read the files. It looks like, although the Splunk port listener is implemented in and supported by Splunk, the Best Practice is to set up a Syslog server to receive the data and then ingest the files in Splunk. The main advantages are that the Syslog server is pretty solid and it NEVER needs to be restarted (unlike Splunk, which needs to be restarted to apply configurations (and we get around issues like this)! ... View more

Did you fix this issue? I am getting the same on my Search Head Cluster. ... View more

Has anyone heard if the compaction process has been added into Splunk yet? We had a KVStore/mongodb database expand too large due to the search that was maintaining the size was not working and so the other searches that were expanding the collection, but not being brought into check by the bad search. ... View more

I am seeing this across the whole of my Splunk ES 5.1.1/7.1.2 system - what version are you using, paddygriffin? ... View more

Ooooh. I feel a proper fool, now! ... View more

This is old now, but this might help someone else. You can override the sourcetype in the props.conf and transforms.conf. Have a look at this: https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Advancedsourcetypeoverrides ... View more

Thanks - I got a bit further, but not quite there with this query: | datamodel | spath input=_raw output=datamodelname path="modelName" | table datamodelname | map search="|tstats count from datamodel=$datamodelname$ | eval datamodel=$datamodelname$ | table datamodel, count" And I get this: datamodel count ---------------- -------- 1928 I get the index and the count, but not the datamodel in the table. I am looking for: datamodel count ---------------- -------- security 1928 I tried: ... View more

I can't believe that no one has got an idea about this (and there have been 55 views with 44 people following this question)! ... View more

I just had a thought., What happens when you do the following query? sourcetype="csv" earliest=-10y latest=+10y Do you get anything then? ... View more

Hi, According to the documentation, here, it says that the TA is compatible with Splunk Enterprise 6.4, 6.5 and 6.6. However, as always, Splunk recommend that you ALWAYS install the app in dev/test and then test it before putting into production. ... View more

I see what is going wrong - you have given the data in the future and so the data is indexed in the future. However, the search is by default in the past. Have you tried using the search: source="New_Excel_B.csv" host="397AD-1A210036" sourcetype="csv" latest=+30d ... View more

Hi, The Splunkbase is a great place to get something that will work, but it is often the case that the use case that the author is creating for is different to that that the downloader is expecting, so sucking and seeing is often the approach that is required. Yes, that is what I would do, however, to make sure that you don't roast your system, I would suggest using a dev environment and set up one and see what it does. I would be really interested to know how you get on. Blessings, BlueSocket ... View more

You ALWAYS configure the Indexes on the indexer(s) before doing anything with the Deployment Server to set up inputs from the forwarders/clients. If you do not do this, you will start getting errors on the Indexers about events being sent to it that are set for an unknown index. So... before you configure the DS to tell the forwarders to send to the new index, make sure that you have configured the new index on the indexers, so that it/they are ready to receive from the endpoints. You CAN SAY that you WANT to set up an index from the Deployment Server, BUT you are only telling the endpont forwarder to create the input and send it to the nominated NEW index on the indexers. If you create the new index on the DS, It WILL create the index on the DS, but this would be redundant, as the DS will not receive the data, as you are forwarding to the indexer(s). Why should we be able to get the DS to create an index on itself? Well, this is valid functionality in the case where there is just one Splunk server, fulfilling all of the roles, as it is an Indexer in that case. ... View more

Well, have you tried using something like this? ... View more

Seems too simple, but could you populate the 4 drop downs manually in the panel so that Splunk wouldn't need to create them itself? ... View more

It's easier to do the drop down, seriously ... View more

Hi, From the documentation, I see that the TA is a standalone app that can be used with the Sophos UTM App for Splunk and the CIM (Common Information Model) to then report upon. Does this help? Kindest regards, BlueSocket ... View more