Whis is as you have 2 UF on same machine. Maybe you should only increase the limits.conf,     [thruput] maxKBps = <integer> * The maximum speed, in kilobytes per second, that incoming data is processed through the thruput processor in the ingestion pipeline. * To control the CPU load while indexing, use this setting to throttle the number of events this indexer processes to the rate (in kilobytes per second) that you specify. * NOTE: * There is no guarantee that the thruput processor will always process less than the number of kilobytes per second that you specify with this setting. The status of earlier processing queues in the pipeline can cause temporary bursts of network activity that exceed what is configured in the setting. * The setting does not limit the amount of data that is written to the network from the tcpoutput processor, such as what happens when a universal forwarder sends data to an indexer. * The thruput processor applies the 'maxKBps' setting for each ingestion pipeline. If you configure multiple ingestion pipelines, the processor multiplies the 'maxKBps' value by the number of ingestion pipelines that you have configured. * For more information about multiple ingestion pipelines, see the 'parallelIngestionPipelines' setting in the server.conf.spec file. * Default (Splunk Enterprise): 0 (unlimited) * Default (Splunk Universal Forwarder): 256     Since by deault it send at 256Kb/s. I set it to 2048 for many UFs which send much data. You could also try a 0 to disable thruput control. ... View more

Splunk now lists this as a known issue and offers a solution. Have not implemented it yet so can't vouch that it works.  We have the had the same issue for awhile.  https://docs.splunk.com/Documentation/Splunk/8.2.4/ReleaseNotes/KnownIssues     ... View more

Have you resolved the issue. I have configured inputs config and see nothing. I saw this error in log file: HTTPError: HTTP 500 Internal Server Error -- {"messages":[{"type":"ERROR","text":"Cannot call handler 'SophosAddOnForSplunk_sophos_central_events' due to missing script 'SophosAddOnForSplunk_rh_soph os_central_events.py'."}]} ... View more

It's been a while. If memory serves me well...I ended up creating a modular input using the Splunk Python SDK. https://dev.splunk.com/enterprise/docs/python/sdk-python/howtousesplunkpython/howtoworkwithusersroles/ ... View more

That makes it a lot faster than before. However, I forgot to mention that I additionally need the hostname field displayed. As soon as I add that field into the search (anywhere), it breaks consistently with what I have done above. ... View more

I have the same issue as you, instead I use a dash and the value. As @niketnilay has stated, seriesColors is the way to go. I applied this to my chart HTML, and used an array of the colors I wanted to use; I only lost some granularity in assignment. <option name="charting.seriesColors">[0x4F2984, 0xFFDD00]</option> ... View more

in this case, the impact is that the events will be larger, and the errors will go away. Generally, adjusting that value will allow for larger events. If your linebreaker is wrong, and you allow jumbo events, the possibility exists that your indexers/HFs will become unhappy. ... View more

I logged a case on 4.7.0, I believe the issue will get fixed in 4.7.2 As a workaround, you can edit : /opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/configuration_checks/confcheck_failed_threat_download.py as below Change: job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest=earliest) To: job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest_time=earliest) The difference on that last line is the earliest_time= setting....once I did that the warnings went away. ... View more

Just got this ourselves on an ES deployment. Will use the workaround for now. Thanks for posting! ... View more

rlog.sh Lowell's file check for rlog.sh works well I believe, still testing. sshdchecker I had an error for sshdChecker.sh and in reviewing it I determined that if you are running Splunk as non-root user (best practice) it probably does not have read access on the sshd_config file so it errors out. Make sure the splunk service account has read access to the sshd_config file. ... View more