I've been trying to filter unwanted events on a heavy forwarder from being sent to indexers. I followed the instructions which I found in here http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Routeandfilterdatad, more specifically, I followed this: Keep specific events and discard the rest This scenario is opposite to the previous scenario. In this example, you use two transforms to keep only the sshd events. One transform routes sshd events to indexQueue, while another routes all other events to nullQueue. Note: In this example, the order of the transforms in props.conf matters. The null queue transform must come first; if it comes later, it will invalidate the previous transform and route all events to the null queue. In props.conf: [source::/var/log/messages] TRANSFORMS-set= setnull,setparsing 2. In transforms.conf: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = [sshd] DEST_KEY = queue FORMAT = indexQueue 1. Restart Splunk Enterprise. But it doesn't work, can someone tell me where is the issue? This is my stanza: props.conf [source::/var/log/messages] TRANSFORMS-null = setnull, setparsing transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = splunk_agent.py DEST_KEY = queue FORMAT = indexQueue ... View more

I am getting the following error in the Search Head running Splunk Enterprise Security: Unable to distribute to peer named splunk_1 at uri https://x.x.x.x:8089 because replication was unsuccessful. replicationStatus Failed failure info: failed_because_BUNDLE_SIZE_EXCEEDS_MAX_SIZE Please verify connectivity to the search peer, that the search peer is up, and an adequate level of system resources are available. See the Troubleshooting Manual for more information. I did some changes to distsearch.conf file, but the bundle is still over 3 GB in size. This is the file stanza: [replicationSettings] maxBundleSize = 4096 [replicationSettings] sendRcvTimeout = 1060 [replicationWhitelist] allConf = *.conf allSpec = *.spec [replicationSettings:refineConf] replicate.app = false replicate.authorize = true replicate.collections = false replicate.commands = false replicate.eventtypes = false replicate.fields = false replicate.segmenters = false replicate.literals = false replicate.lookups = false replicate.multikv = false replicate.props = true replicate.tags = true replicate.transforms = true replicate.transactiontypes = false [replicationBlacklist] nopyc = apps[/\\]...[/\\](bin|contrib|lib)[/\\]*.py[co] nopyc2 = apps[/\\]...[/\\](bin|contrib|lib)[/\\]...[/\\]*.py[co] nocsvdefault = apps[/\\]...[/\\]lookups[/\\]*.csv.default nolearned = apps[/\\]learned[/\\]... notracker = apps[/\\]...[/\\]lookups[/\\]*tracker.csv notracker2 = apps[/\\]...[/\\]lookups[/\\]*tracker2.csv nosigref = apps[/\\]...[/\\]lookups[/\\]*signature_reference.csv nosigref2 = apps[/\\]...[/\\]lookups[/\\]*signature_reference2.csv noeditablelookups = apps[/\\]...[/\\]lookups[/\\]editable_lookups.csv nolegacycontexts = apps[/\\]...[/\\]contexts[/\\]*.context noconvertedcontexts = apps[/\\]...[/\\]lookups[/\\]*.context.csv.old noinstallsrc = apps[/\\]SplunkEnterpriseSecuritySuite[/\\]@installsrc@[/\\]... lookupindexfiles = (system|apps/*|users(/_reserved)?/*/*)/lookups/*.(tmp$|index($|/...)) sampleapp = apps/sample_app/... conf = (system|(apps/*))/(default|local)/server.conf user_specific_meta = users(/_reserved)?/*/*/metadata/local.meta framework = apps/framework/... ... View more

I've been trying to set up the Splunk Enterprise Security app, but I came across an issue that I can't find references to online. Unable to distribute to peer named indexer1_hostname at uri https://xx.xx.xx.xx:8089 because replication was unsuccessful. replicationStatus Failed failure info: failed_because_BUNDLE_SIZE_EXCEEDS_MAX_SIZE Please verify connectivity to the search peer, that the search peer is up, and an adequate level of system resources are available. See the Troubleshooting Manual for more information. Can someone already came across a similar issue? Thanks! ... View more

I've been trying to ingest logs from a single log file into 2 source types. For example, looking at the 'messages' file in Linux, I want to split the logs from this file into different source types or indexes. Sourcetype 1: Jul 10 09:20:01 systemd: Started Session 27535 of user root. Sourcetype 2: Jul 10 09:13:26 rsyslogd: [origin software="rsyslogd" swVersion="X.X.X" x-pid="18406" x-info="http://www.rsyslog.com"] rsyslogd How should I approach this? ... View more

I've been trying to join two indexes: Windows Security index and a proxy one, but after running the search below, I only get some logs back, very little, or almost nothing. The idea is to build a search to monitor proxy logs for some selected users. However, user names are in Windows Security logs, so that's why I need to join these two indexes together to be able to search proxy logs based on the user names. index=wineventlog user_name | join src [ search index=proxy | fields _time, category]|table category ... View more

How can I keep the expanded panel in a dashboard after refreshing the browser? For example, I have a dashboard which has 3 panels, two at the top at the same level, and one under these two panels. There a little 'dot' on the one of the panel to expand it by dragging it down. But, how can I keep it this size after expanding the right panel and after refreshing the browser? ... View more