I'm not sure why anyone would want "a holistic view" of the credentials on the instance when they have nothing to do with the app in question. This was an poorly conceived requirement, in that case. I can confirm that a newly created credential DOES NOT appear on the credential tab. I see THIRTY credentials on the credentials tab and exactly the same number after I add a new one. The new one is not in the list. This begets a new question: Is there a limit of 30 credentials on that page and does the uninformed decision to just list everything now prevent new credentials from appearing? There is no "next page" offered, so as far as I can tell, there is simply no credential created. Other apps require the creation of a credential and then an input, which is associated with the pre-existing credential. (Those apps, by the way, don't show every other app's credentials. Just say'n.) ... View more

Hi Satya, This may be because Splunk was not able to read the correct timestamp in the file, sometimes it's thinking them as dd/mm/yyyy and sometimes as mm/dd/yyyy, please go through the doc below. https://docs.splunk.com/Documentation/SplunkCloud/7.0.0/Data/Configuretimestamprecognition#Enhanced_strptime.28.29_support Let me know if it works. ... View more

To answer your questions: Setup Addon using deployment server You need to install addon on deployment server and then go to manage apps-> search for TA_EMC-Isilon Click on the Setup under Actions tab Provide details and save the configuration Then copy the whole folder from $SPLUNK_HOME/etc/apps to $SPLUNK_HOME/etc/deplyment-apps Then push the app. For the above approach you might need to make splunk.secret same on both deployment server and forwarder(/splunk/etc/auth/splunk.secret). syslog.conf configuration !audit_config . /var/log/audit_config.log . @10.0.11.238 !audit_protocol . /var/log/audit_protocol.log . @10.0.11.238 allow 514 port to receive data firewall-cmd --zone=public --add-port=514/udp --permanent We will not be able to send data on a different port. we must need to send data over 514 port. Below is the link: https://www.dell.com/community/Isilon/How-to-enable-syslog-forwarding-from-Isilon-OneFS-on-Custom-Port/td-p/7147995 Let me know if you need any further help. ... View more