Hi. I did this yesterday and on the indexer i needed to change the server.conf inputs.conf server.conf [sslConfig] sslRootCAPath = /opt/splunk/etc/auth/cacert.pem inputs.conf [splunktcp-ssl:9997] disabled = 0 [SSL] serverCert = $SPLUNK_HOME/etc/auth/server.pem sslPassword = password requireClientCert = false On the uf, i needed to add - outputs.conf - server.conf output.conf [tcpout] [tcpout:group1] server = 192.168.1.79:9997 clientCert = $SPLUNK_HOME/etc/auth/server.pem sslVerifyServerCert = false server.conf [sslConfig] sslRootCAPath = /opt/splunkforwarder/etc/auth/cacert.pem I don't know if its 100% correct, but it worked in my lab environment. ... View more

Hi. Make sure that you take backup of all the files and i would upload it via CLI if i were you, then you can make sure that all files in your app/local folders are staying intact. ... View more

Do you have correct timestamps on the logs? Else you may index them in the feature or in a year waay back in time. ... View more

When you stop splunk it still keep getting the syslog meaning when you start again it is falling behind and can't catch up in time (for some reason) I would look on the queues on on the HF and on the indexing tier to see where the bottleneck is. I would also look in the internal log and see if there is any errors on the monitoring path (to big files or such error) ... View more

What do you get in your splunkd log? ... View more

Since the license is not based on event count, nor is it based on how much data you send to an indexer tier. If the indexer modifies the event data (masking, filtering, etc.), only the data that is actually written to disk counts towards your license. If there is no index specefied or if it is disabled and no default index that gets the data instead, i would see if you can find the data on disk, if not i would send in a support ticket. How do you know that your HEC data that is not written to disk is counted towards the licensing volume? ... View more

What you mean by "accessed", do you mean how many time somone searched in an index? That information can you see in _audit. ... View more

Then you will override your daily license quota that is 50GB. I would talk with splunk sales representive regarding what happens if/when splunk get info on what you are doing. ... View more

There is no such thing as a single-user license, as far as I know. As of version 4.2(?), there is a mechanism within Splunk, that allows several instances to share a single license. In theory, since you can install the same license on multiple machines, you could have multiple license masters but a license slave can only be the slave of one license master. As long as you do not go over the license limit in total amount of indexed data you should be fine. ... View more

First of all read https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Routeandfilterdatad If your data have not been going trough any processing first then you can use props/transforms on your indexer and route events to null queue if you do not want it to be calculated to your licensing. (Same as you can use splunk on a single machine that can take all roles, but it is not recomended for enterprise installations) ... View more

Are you really sendin your data to index _internal? Check the inputs and see index-name and that you have that index created. else search for errors on the hosts that you deployed it on in the splunkd.log for mre info. ... View more

Problem as i got it is from a regex in the file on the splunk installation so splunk will not be able to read timestamps with a 20 instead of 19 in the start. They do not have 2020 in the regex but only 2010-2019 (simplified) Meaning that we need to update that file datetime.xml on all hosts that process data with timestamps. ... View more

You do a REST api search towards the index and collects the data that way. ... View more

Not what i can come up to at the moment i can talk to some colleages that did the ES implementation, but it was a long time ago. Just follow the documentation and im sure it will go smooth. ... View more

We index about 6TB a day. All log go trough Heavy forwarder before they reach the indexers, and we have just implemented some indexers on an other cluster on Google Cloud Platform aswell to make it easier to scale the environment. ... View more

Hi. We run both on a multisite index-cluster with 60 indexers without any issues. ITSI runs on a search head cluster with 8 search head ES runs on a ES search head cluster with 4 search heads. ... View more

Can you show the indexes.conf config and how you set the max index size? Are you sure it is not bucketsize you have set? Do you have warm and cold on the same partition? ... View more

Splunk cloud gets upgraded automatically. The one that is responsible will get email before hand om what dates the upgrade will be on. ... View more

Write your alert data to a summary index. Make the python script query the summary index and if there is new data there do your magic like taking out the hostname (that is alerted into the summary index) This require your script to query that index all the time, but i do not think there is any better options. ... View more

Do you have any events at all? Did you import all the data from the lab 4? Follow the lab 4 instructions and make sure you get all events you need. You download a zip-file and ingest data into splunk. ... View more