Hello, I have a standalone Splunk Enterprise system (version 9.x) with 10 UFs reporting (Splunk Enterprise and the UFs are all Windows OSs) - the Splunk Enterprise standalone system is an all-in-one: indexer, search head, deployment server, license manager, monitoring console... I created a deployment app which to push out a standard outputs.conf file to all the UFs and it pushed out successfully, just like all the other deployment apps.  I deleted the ~etc\system\local\outputs.conf from the UFs, restarted Splunk UF, made sure that the deployment app showed up in ~etc\apps\ (it did).  But now that the outputs.conf is no longer in ~etc\system\local, I'm getting this: WARN AutoLoadBalancedConnectionStrategy [pid TcpOutEloop] - cooked connection to ip=<xx.xx.xxx.xxx>:9997 timed out  I've made sure there isn't any other outputs.conf, especially not in ~etc\system\local it that it doesn't mess with the order of precedence, restared the UF, and everytime I get the same Warning...and of course, the logs aren't being sent to the indexer.  But it does still phone home, but no actual logs. When I run: btool --debut outputs.conf list  I don't get any output. But as soon as I get rid of this deployment app and put the same outputs.conf file back in ~etc\system\local, restart the UF, logs are being sent to the indexer.  And my deployment app's structure is the same as the other deployment apps that do work...What am I doing wrong? Thanks. ... View more

I stood up a new set of indexers this weekend and set my RF=2 and SF=1 on the CM with the hope that the old indexers will replicate the data and populate the new set of indexers (I'm going to eventually decom the old indexers). However, that doesn't seem to be working.  All the peers are up and running, and UFs are sending data correctly via indexer_discovery...but the data isn't being replicated.  My question is, why aren't my indexes (other than these native ones) showing up here on the CM? (Settings > Indexer clustering > Indexes tab: Only native indexes are showing up on cluster master. ... View more

Hi, I know there are other ways to get this through the deployment server, but I'm trying to find a SPL to get results of which of my Splunk UF clients currently has a specific deployment app. I have been able to use this SPL to find all all deployment apps on all my Splunk UF clients:   | rest /services/deployment/server/clients splunk_server=splunkdeploy01* | table hostname applications*.stateOnClient | untable hostname applications value | eval applications=replace(applications,"applications\.(\w+)\.stateOnClient","\1") | stats values(applications) as applications by hostname   However, I'm looking for a SPL that searches across all Splunk UF clients for a specific deployment app: "all_splunk_uf" Thanks! ... View more

All of my Splunk alerts and reports are getting quarantined by Microsoft's spam filter, the reason being: "Quarantine reason: Phish". The alerts are simply sent from "splunk" with no email address associated with it, so I can't even add it to "Safe Senders/Recipients". ... View more

Splunk Enterprise 6.5.3 I have created a report to email me a .pdf . However, the report does not include the hostnames of the servers that it is reporting on. I am using the following search regex: index=dba host=db5 "Error" OR "Warning" OR "Note" And it shows host=sdb5 in the selected fields, as well as in the area immediately beneath the log data, but the host (hostname) will not appear in the report that is generated via an email. I only get the timestamp and the event (actual log data). Is there a way to ensure that the hostname is included as part of the report? ... View more

In our Splunk forwarder, in the path: /opt/splunk/etc/apps/app01/default we have many stanzas such as: [monitor:///export/data/syslog-ng/sentry*/messages] disabled = false host_regex = /export/data/syslog-ng/(.*?)/messages index = asalg sourcetype = cisco_asa And under every stanza there is the following line: host_regex = /export/data/syslog-ng/(.*?)/messages I am very curious to know what the "/(.*?)/" means? Thank you. ... View more

Is there a way to see how much data we are getting in from Active Directory, Exchange and Radius (size of the indexes/number of days the data goes back)? Splunk version: 6.5.3 Enterprise distributed environment. ... View more