Check out our otel image. It replaces fluentd-hec anyways. ... View more

Hi ykpramodh How did you configured KV Store replication ? Can you share your experience please? Thank you    regards Vladimir ... View more

Are you using active-choices-plugin ( https://wiki.jenkins.io/display/JENKINS/Active+Choices+Plugin) ? It seems there is a groovy script error in the active choice plugin config No such property: url for class Script1 I think once you fix the script, the error will gone ... View more

@LukeMurphey - I do not see any way to edit permissions on the list page. I am on v2.7.1 of the Lookuop Editor. I am running this app on an Enterprise Security search head with Splunk v6.5.1 - screenshot - https://imgur.com/a/AR5pv ... View more

Ugh, but it literally says INDEX in its name! Thank you guys. ... View more

Disclaimer: This is VERY VERY VERY unsupported. I know this is old but it popped up and, in case other people want to know, I thought I'd share. The mongodb instance used by Splunk for kvstore requires client SSL to authenticate. If you have the mongodb client installed on the syste, you can authenticate as such: mongo --sslAllowInvalidCertificates --ssl localhost:8191/local --username __system --password $(cat $SPLUNK_HOME/var/lib/splunk/kvstore/mongo/splunk.key) ... View more

Thanks for the response, I will be commenting every question you asked in the following lines: Do you have any reason to not connect your new HF directly to your indexers? It seems like an odd topology to have HF --> HF --> Indexers. Yes, there is a reason why we want to do this. We want to separate and filter separate things in every HF. In the first one we will redirect indexes and on the other one we will filter events. In both we are using props and transforms files to do this. Is the universal out of the picture now and you've replaced the Universal Forwarder with a Heavy Forwarder? Yes, the universal no longer exists. Now we have only HF. Will it still match on the same hostname? You're doing that filtering in props with a specific hostname so make sure that hasn't changed. Yes, the hostname is the same. We are asking the community because we are not sure if this is even something possible. It is our desire, due to topology needs but if it is not possible we will move back to the configuration we had before. Thanks! Best Regards ... View more

It looks like this only can be done at hf or indexer level as I suspected, but not in universal forwarder: "Although similar to forwarder-based routing, queue routing can be performed by an indexer, as well as a heavy forwarder" ... View more

The timechart would not give a column reqtime but each uri would be one column. I guess you want to use bucket-chart combination here. ... View more

Adding more hardware is not an option at this moment. We are talking about servers with 32 cpu and 128gb of ram. The other option was running with a deprecated search pool in 6.3. I will take a look of these parameters. Thank you ... View more

correct. the best method is not avoid monitoring the bad event in the first place. But we cannot filter an event before it has been break down to a proper event, you do not want to delete a whole file if only one event match the filter 🙂 ... View more

I've revised the forwarding of the internal logs and is configured indeed... the outputs.conf in our searches is nailed with the outputs covered in http://docs.splunk.com/Documentation/Splunk/6.3.1/DistSearch/Forwardsearchheaddata In fact, a search query on _internal shows all hosts in our cluster environment. Is crucial for us to see the the activity on any search heads. Editing the server query I see that |inputlookup all_servers.csv only returns our indexers To see what is happening I have playing with the 6.1 lookup and I see that my searchers are being discarded because the join with the rest call is not returning values for the search heads. This query index=_internal sourcetype=splunkd component=ServerRoles role!=license_slave* role!=search_peer* |rex field=role "(?<role>\S+)\." |dedup host role | join host [|rest splunk_server=* /services/server/info | rename serverName AS host | fields host guid version] | rename server_role AS role | table host role guid version returns only the indexers this one index=_internal sourcetype=splunkd component=ServerRoles role!=license_slave* role!=search_peer* | table host role guid version return them all ... View more

The information you are looking for is in etc/pooling/pooling.ini [general] guid = 80D0C74D-0819-4AA4-B5D8-C5EB5e41029B kvstore_secret = 5cdae94f7015f55698abb975R2c7818e3fabaa9e3001f61b3942ee3bfd854338 kvstore_active_members = 99145D4E-6AF2-4D0C-8DCB-269027785CAD,B76C11A2-49F1-458A-9EA2-7C877B06CAF4 kvstore_sync_master = B76C11A2-49F1-458A-9EA2-7C877B06CAF4 [kvstore] host1 = host1.mylocaldomain:8191 host2 = host2.mylocaldomain:8191 So, I suppose that must be part of head pooling in order to read this configuration and sync the mongo db ... View more

I downvoted this post because it doesn't return all the values ... View more

I cannot delete either. I get an error: curl -k -s -u admin:changeme https://localhost:8089/servicesNS/nobody/myapp/storage/collections/config/test_collection_collection -X DELETE <msg type="ERROR">Object id=test_collection_collection cannot be deleted in config=collections.</msg> ... View more

I can't say that I'm familiar with how file scraping operations work in Splunk for this case. For my current case, I made a new UDP input to take in the logs: [udp://7227] connection_host = dns sourcetype = cisco:acs no_appending_timestamp = true (Sorry for the really late reply ... I haven't been doing much Splunking in the last year or three.) ... View more