As khourihan mentions, you wont get access to the SSH. Most of the admin functionality you can perform from the current GUI of cloud, anything outside of that you need to contact support and open a request for them to do it. ... View more

Do you have a search head cluster or search head pool? If so, can they telnet to the others just fine on the same kv store port? If it's more than one search head, you shouldnt be testing telnet from the local machine to the local machine, but making it traverse the network path between two machines instead. ... View more

Ok will correct it now and update you.. ... View more

Have you verified that port 9997 is open between the devices using something like telnet? telnet x.y.z.a 9997 Should give you a blank screen with blinking cursor. You'll have to press ctrl + ] to break out of the telnet session. If you dont get the blank screen with blinking cursor, the port isnt open or the indexer isnt listening On the indexer you can run netstat -an | grep 9997 to see if it's listening on the port. ... View more

Hey, We found the issue and here is the solution. On the Windows server, you need to configure this: C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf [WinEventLog://System] disabled = 0 blacklist1 = EventCode="7036" and it works. I stopped getting events with code 7036. Tnx for your help from the beginning !!! ... View more

Tnx for the reply, yes the data indexed on internal source and i am able to see local linux logs. When it comes to Win & Linux remote machine i got NO data events. I installed splunk 6.2.3 instead splunk 6.3.1 but still the same issue ( ... View more

Did you try this instead? go to settings -> Forwarder Management. Once there, you can click on server classes and so on. I'm not 100% certain this shows up on an indexer/deployment server combo as I've always kept deployment separate. ... View more

Can you explain what you are trying to do in general? Why do you need to configure your Windows forwarders using your own custom code vs. using the Splunk-supplied configuration mechanism known as the Deployment server? The DS allows you to group similar forwarder hosts together into what's called a server class, and ensure that all machines in a given server class get the same Splunk configuration applied to them. On the forwarder side, you define the deployment server address once (in deploymentclient.conf) and from there on, the forwarders will keep there configuration in synch with what is specified on the deployment server. The link above documents the REST API call you can use for BOTH, local as well as WMI-based inputs, depending on the lookup_host and name attributes. Understanding your requirements better would help in guiding you down the best path. ... View more

Not very clear on the question, however in authorize.conf we have few parameter to restrict the index from viewing for specific roles. You can actually refer below doc for more information. https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Addandeditroleswithauthorizeconf#Search_filter_format and also, you can refer below splunk answer for reference. https://answers.splunk.com/answers/672165/how-to-build-a-srchfilter-when-two-indexes-are-all.html ... View more

I posted a new question thread here: https://answers.splunk.com/answers/504256/fortinet-fortigate-app-for-splunk-not-showing-data.html Thanks, Lee ... View more