You're welcome! Just sharing in case others in the community run across the same issue. 🙂 ... View more

Fantastic! Glad that did it for you! And thanks for sharing the final results that worked best for you! ... View more

Slight correction....this should be in savedsearches.conf now....not correlationsearches.conf. correlationsearches.conf got deprecated in ES 4.6. So, if you are working in something older than 4.6, use correlationsearches.conf....4.6 and newer, use savedsearches.conf. ... View more

There is a way. You'll need to edit the "correlationsearches.conf" file, find the stanza in the file that is associated with the Swim Lane Search you created and then under that Swim Lane Search's stanza add the line display.page.asset_investigator.0.collection_name = Default line. Just make sure you choose the proper investigator for the search - either asset or identity - in the line you add to the stanza. You'll also need display.page.asset_investigator.0.order = 1 if its not already there. That ought to get the newly created swim lane search added to the default collection. ... View more

That is great news! Glad we were able to help you out and get you headed in the right direction! You're welcome! ... View more

If the Heavy Forwarder is just configured to forward what is being sent from the Universal Forwarder, then that would explain or could potentially explain why it is still going to the default or main index at the Indexers. The Heavy Forwarder only applies the configuration files when you are storing data on it and not just forwarding it on. In this case, you need to go to the Universal Forwarder and modify the conf file there to define the index you wish to forward the defined inputs for. Test it by making the change on one of the Universal Forwarders and see if you are getting data into the index then. ... View more

Are you collect data to the Heavy Forwarder using Universal Forwarders from individual hosts/servers/computers? Or how does data come into the Heavy Forwarder? Is the Heavy Forwarder only being used to consolidate to a single data stream into the Indexers or are you doing any sort of manipulation of the data once it hits the Heavy Forwarder, i.e., are you doing some sort of filter and routing type configuration? ... View more

Hello @AlexeySh.....no worries....glad you were able to get an answer. ... View more

This is done by modifying the navigation menu which is defined in the default.xml file located in the following path: $SPLUNK_HOME/etc/apps//default/data/ui/nav/ You can find more information on this as well as how to make other customizations similar to this here: http://dev.splunk.com/view/SP-CAAAEP9 The actual views or the content of the landing page will go in: $SPLUNK_HOME/etc/apps//default/data/ui/views/ The static content for the HTML files go into the following paths: $SPLUNK_HOME/etc/apps/your_app_name/appserver/static/ Under here you would have directories and associated files for html, css, images, and js. Here's some documentation around this too: https://docs.splunk.com/Documentation/Splunk/7.1.1/AdvancedDev/UseCSS ... View more

Assuming you are using the dbxlookup command or dbxquery command, you need to go to the "manage app" page and select "View objects for the DB Connect app. On that page, you will see dbxlookup, dbxquery, etc. and will need to make sure Sharing is set to Global for this capability. I think that might be the issue, especially if you are using those commands. ... View more

Have a look here: https://answers.splunk.com/answers/155769/app-for-stream-pcap-replay.html and here: http://docs.splunk.com/Documentation/StreamApp/7.1.2/DeployStreamApp/ConfigureStreamForwarder#streamfwdcapture_examples Specifically, Example 4. I think that may hold the key to resolving things and allow you to replay after you upload the pcap to the correct location. ... View more

To me, this just calls out for the use of Summary Indexing instead of trying to do it via other means: http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/Usesummaryindexing Have you looked into this or attempted to try an approach that uses this? ... View more

Here's what I could find on this: appOrder: A per user app order is maintained within /services/data/user-prefs endpoint, under the appOrder key A default app order is specified in etc/apps/user-prefs/default/user-prefs.conf By default, appOrder=search, causing the search app to appear first in the UI. display.page.home.dashboardId: When users first view the new home page, they will see a call-to-action for choosing their home dashboard. The id for their selected dashboard is stored in userprefs.conf as the field "display.page.home.dashboardId." eai_app_only: Working on this one.....not sure but it always seems to be set to False. Will update as soon as I get an answer. eai_results_per_page: Tells the number of results you get when you search. If you go to e.g. settings/all configurations, it will show you 100 items each page. restart_background_jobs: Restart background search job that has not completed when Splunk Enterprise restarts indication: true = Restart job. false = Do not restart job. showWhatsNew: A per user "showWhatsNew" flag is maintained within /services/data/user-prefs endpoint. By default, the value is set to "1", indicating to the UI that the dialog should be displayed. When the dialog is closed, the value is changed to 0. This will happen no matter where the user is when they close the dialog (not just on home). I'll provide an update on the "eai_app_only" parameter once I hear back from others. PD2 ... View more

Another thought here is leveraging the whitelist and blacklist parameter of the file monitoring: http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Whitelistorblacklistspecificincomingdata In essence you could modify the inputs.conf add in the blacklist parameter that includes the alert_log file names. Any time those pop up, they would automatically be handled with not being indexed at all into Splunk. If you still needed the alert_log file on a regular basis you can always comment out the blacklist line then remove the "#" when you need to invoke it. No, you cannot do this via CLI commands, but, IF you are using the Deployment Server to manage your Splunk Forwarders you could make one change via the web GUI for this blacklist and have it update globally to all Forwarders that have this inputs.conf stanza. ... View more

Yes, that's exactly what I was trying to do. But I think since we now have the Eventgen on splunkbase.splunk.com (or at least a reference so that people can go download it and use it) I'll do what you recommended and just keep the eventgen/ separate. I just did a test run of the app I'm creating with the eventgen.conf and samples/ directory in my app and then installed the eventgen via the Splunk web gui and it worked fine. Yes, its another step for people, but it keeps the package clean and plus, I do want to upload this one to splunkbase.splunk.com. Thanks Jason! ... View more

So though I can ta/gzip the package with the eventgen stuff, Splunk's app management/installation will not allow me to include all the directory and files associated with eventgen/? I'd really like to have this so that a customer could install it in one shot like that...... ... View more