Hi. I was wondering. In a 2 UF, 2 Idexer setup, where UF config looks like this: [tcpout:SplunkIndexerGroup1] server = SplunkIndexer1:port,SplunkIndexer2:port autoLB = true useACK = true [tcpout] defaultGroup = SplunkIndexerGroup1 disabled = false If i send regular syslog data via UDP to both UF simultaneously, (ie. Cisco ASA logs), they will both forward the log to the inderxers where they both will be stored as duplicates. How can i make it so that it will only forward 1 of the logs, or know that it is a duplicate and only index one ? ... View more

As the title says. Forwarder File Monitor stopped working at 23:59 June 30th 2013 inputs.conf: [monitor://E:\Logs] disabled = 0 sourcetype = mftlogs [WinEventLog:Security] disabled = 0 Debug: 07-01-2013 13:51:05.570 +0200 DEBUG TcpOutputProc - Registering Channel for : source::E:\Logs<removed>.log|host::MFTD|mftlogs| :9997, oneTimeClient=0, _events.size()=0, _refCount=1, _waitingAckQ.size()=0, _supportsACK=0 07-01-2013 13:51:05.570 +0200 DEBUG TcpOutputProc - Unregistering Channel for : source::E:\Logs<removed>.log.log|host::MFTD|mftlogs| :9997, oneTimeClient=0, _events.size()=1, _refCount=2, _waitingAckQ.size()=0, _supportsACK=0 Windows Eventlog still gets inserted into splunk, but not the logs. Anyone ? 😞 ... View more

When using Splunk through Cisco ASA Clientless WebVPN, none of the dropdown menus work. Am i doing something wrong, is it a bug, or is it just the way the dropdown menus work that cannot be used through a proxy system like WebVPN ? ... View more