Thanks, I think https://docs.splunk.com/Documentation/Splunk/9.2.1/InheritedDeployment/Ports is the one included? ... View more

Hi just make sure all logs are forwarded properly and check below video for configuration  it will defiantly help u  https://www.youtube.com/watch?v=ToAuSf_DXL4 ... View more

i wanted to get below logs from sql server. who has accessed the database recently - what change has been made on the database recently - which new user has been created on the DB recently   Splunk Add-on for Microsoft SQL Server : do not give above logs. Please suggest ... View more

I've attempted to provide an exhaustive answer to this at What is the best practice to address the "..is neither in the bundle downloaded from master nor managed by local deployment client..." validation failure? ... View more

Use hostname+domain_name or else use the IP to get the ping results. How to get the host_domain name: see in DHCP logs under dns_hostname filed or else get the IP from either of the sourcetypes and search using |ping $host$.group.local ... View more

Thanks for prompt support. With earliest 30 days, it takes way too much time and showing lot of users with 1 logins, i dont think these many users accessing their dormant a/cs in our environment. ... View more

you are right, this was coming from another app blueliv, we corrected it and its fine now. Thanks @btorresgil for prompt response. ... View more

Hi, just found this discussion... I know you solved your problem, which is great (BTW: marking this discussion as answered would help others :-). The main part is the filtering of internal logs if you use an intermediate forwarder architecture, like you do. You found the black/whitelisting. Much easier would be: forwardedindex.filter.disable = true which if off (=false) by default. This is needed on the intermediate HF in your case. Hope to help others for future reference. Happy splunking, Holger ... View more

You can ecrypt the splunk buckets with Vormetric Data Encryption. A VTE agent running on each indexer. This provides an overlay Security File system on top of EXT4/XFS etc. The vormetric policy allows for the splunk binary (splunkd) and other processes permission to the guardpoint (data path /data/hot for example). When data is written to the hot dir. it's enrypted on the way in. When splunkd reads the data back into memory it's decrypted on the way out. This is basically a shim in the I/o path. We have done this successfully on several systems. Performance is around 2% CPU up to 70% CPU utilization. With Vormetric's Live Data Transformation (LDT), we can apply the VTE Guardpoint on cleartext buckets with only a momentary downtime of the indexer to erect the guardpoint. At that point, the data being written and read is immediately encrypted with key. The exisitng data will be encrypted in the background based on the QOS schedule that is set. For my particular implementation, we set the QOS on LDT for 5pm - 7am M-FR. The background enxcryption for these particular indexers took about 2hrs to complete while the read/writes continued. We have key versioning set that is automatically kicked off at 180 days. LDT takes care of understanding data read with key version 1 and then writing back with key version 2 if key versioning date it hit. It's pretty easy policy vormetric wise to take care of any processes that need permission in the guardpoint. ... View more

How will I be able to clone the roles? I am checking this thread because I will transfer my splunk instance to a new account. Thank you so much! ... View more

These dashboards require the Ldap Search support app running in the background doing queries. so you need this app installed on the searchhead as well. These dashboards do live queries to AD. These two links show help: The first one explains that you need the ldapsearch app. http://docs.splunk.com/Documentation/MSApp/1.3.0/MSInfra/TroubleshoottheSplunkAppforWindowsInfrastructure http://docs.splunk.com/Documentation/SA-LdapSearch/2.1.3/User/ConfiguretheSplunkSupportingAdd-onforActiveDirectory ... View more

Thanks! This works. The documentation states that the Splunk Add-On for Unix & Linux needs to be installed only on the forwarders & indexers. This clearly is not the case because without the Add-on on the search head, the parsing does not work & the dashboards are not populated. ... View more

16 EB - check ... View more

It would tough to suggest you anything without knowing more information here. Where are the CSV files location, are they available as lookup table file (under etc/apps/YourApp/lookups) OR they are regular CSV files that you can copy to Splunk search head server (under $SPLUNK_HOME/var/run/splunk) OR they are indexed into Splunk under an index and sourcetype?? There will be different method/command to retrieve the data from both CSV based on this (inputlookup OR inputcsv OR regular base search). Once that is available, you can compare the data like this (again what all fields are there and what you want to compare will derive the result here), assuming there is a common field between those two CSVs... [Search to get data from CSV1 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV1" | append [Search to get data from CSV2 | table commonfield fieldtocompare1 field2compare2... | eval from="CSV2"] | chart limit=0 values(fieldtocompare1) as fieldtocompare1 values(fieldtocompare2) as fieldtocompare1 over commonfield by from This should give you fields like fieldtocompare1:CSV1 and fieldtocompare1:CSV2 which you can compare using eval or something. ... View more

In 5.0 we moved the lookup tables from the app to the add on. So you will need to confirm you have the add on installed and just delete the lookup tables from the app. ... View more

@idurrani, You're asking a new question rather than answering the one asked by the OP. Please post a new question about your problem. ... View more

I posted a new question thread here: https://answers.splunk.com/answers/504256/fortinet-fortigate-app-for-splunk-not-showing-data.html Thanks, Lee ... View more

In approximate order of how I'd do it: First, double check for sure you aren't getting them in. index=* and start looking at all your flyouts for your host, events that may come from it and so on. Double-check you are listening on both UDP and TCP port 514 in Splunk, or confirm that whichever one you are listening on is the one that Trend is sending in on. Double-check your inputs.conf to make sure there shouldn't be anything mishandling that source - the list of trickery that could be involved is long, but a careful look will most likely uncover anything odd looking. Confirm that Trend is configured properly and pointing to the right IP address, is actually set to send something in (sometimes the configuration for syslog settings and the configuration to send syslog data are two entirely separate steps!) and that there are no firewalls or networking issues that would prevent the two machines from communicating. Once you've double-checked all that work and found no improvement, I'd say to start a packet capture on your Splunk server watching for packets from the Trend box. If you see them coming in over the right ports and all that, you'll have to look at inputs. (Or separate syslog from Splunk and troubleshoot each piece separately, as below). If you don't see the inputs, then either the Trend box is misconfigured or there's a firewall or something in the way. I, and others here, would heartily recommend to install syslog-ng or rsyslog and use THAT to listen to syslog, then use monitor stanzas to get the data from there: this is easy to do and has a lot of advantages in speed, reliability, scalability and troubleshooting. That last advantage would be quite useful at this point and would separate this problem into two independently easy problems. This is also best practice. ... View more

Just got this ourselves on an ES deployment. Will use the workaround for now. Thanks for posting! ... View more

Splunk Cloud includes a monitoring Console app that shows you your daily indexing volume over the last 30 days. ... View more

I'm running into an issue where I accidentally didn't drop the png file into the /opt/splunk/etc/app/search/appserver/static/logincustomlogo/ folder and got a broken image link. I dropped the file and restarted splunk but still getting the broken link. Has anyone else ran into this issue? Thanks, ... View more

A good pointer. thank you. ... View more

@Raghav2384 could you please share script or suggest something on this to me and @mmensch thanks in advance ... View more

Thanks @kristian.kolb ... View more