Has anyone had issues with the Splunk Add-on for F5 BIG-IP setting/separating the sourcetypes? According to the documentation, if the sourcetype is set to f5:bigip:syslog, the data should be separated into its specific sourcetypes (f5:bigip:apm:syslog, f5:bigip:asm:syslog, f5:bigip:icontrol, etc), but all of our sourcetypes are still coming in as f5:bigip:syslog. Is there anything specific that I need to change in the configuration files so that these sourcetypes are automatically updated? Thanks. ... View more

Hi, We are trying to apply the Splunk Add-on for Microsoft Hyper-V to an indexer cluster bundle. When running the command, we receive the following error: In handler 'clustermastercontrol': The Master could not push the latest configu ration bundle because it contains an invalid configuration. Fix any errors and p ush the bundle again. Alternatively, you can skip the validation process like th is: "splunk apply cluster-bundle --skip-validation". Use this option carefully, as it can cause the master to push an invalid configuration to the peers. The fo llowing errors were encountered: ; Value in stanza [eventtype=hyperv:inventory] in C:\Program Files \Splunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 3 no t URI encoded: eventtype = hyperv:inventory ; Value in stanza [eventtype=hyperv:vm] in C:\Program Files\Splunk \etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 12 not URI encoded: eventtype = hyperv:vm ; Value in stanza [eventtype=hyperv:alerts] in C:\Program Files\Sp lunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 17 not URI encoded: eventtype = hyperv:alerts ; Value in stanza [eventtype=hyperv:performance] in C:\Program Fil es\Splunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 22 not URI encoded: eventtype = hyperv:performance ; Value in stanza [eventtype=hyperv:disk] in C:\Program Files\Splu nk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 25 not UR I encoded: eventtype = hyperv:disk ; Value in stanza [eventtype=hyperv:network] in C:\Program Files\S plunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 28 not URI encoded: eventtype = hyperv:network ; Value in stanza [eventtype=hyperv:processor] in C:\Program Files \Splunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 31 n ot URI encoded: eventtype = hyperv:processor ;No spec file for: C:\Program Files\Splunk\etc\master-apps\avn_its_TA_microsoft- hyperv\default\eventgen.conf ; Value in stanza [eventtype=hyperv:inventory] in C:\Program Files \Splunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 3 no t URI encoded: eventtype = hyperv:inventory ; Value in stanza [eventtype=hyperv:vm] in C:\Program Files\Splunk \etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 12 not URI encoded: eventtype = hyperv:vm ; Value in stanza [eventtype=hyperv:alerts] in C:\Program Files\Sp lunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 17 not URI encoded: eventtype = hyperv:alerts ; Value in stanza [eventtype=hyperv:performance] in C:\Program Fil es\Splunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 22 not URI encoded: eventtype = hyperv:performance ; Value in stanza [eventtype=hyperv:disk] in C:\Program Files\Splu nk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 25 not UR I encoded: eventtype = hyperv:disk ; Value in stanza [eventtype=hyperv:network] in C:\Program Files\S plunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 28 not URI encoded: eventtype = hyperv:network ; Value in stanza [eventtype=hyperv:processor] in C:\Program Files \Splunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 31 n ot URI encoded: eventtype = hyperv:processor We have confirmed that the configuration files are using UTF-8 encoding. Any ideas what the issue could be? ... View more

I am trying to integrate Splunk with an internal Identity Provider but have been unsuccessful. I know that Splunk supports PingFederate's Ping Identity but would like to know if anyone has been able to integrate with an IDP other than Ping Identitry. Thanks in advance for any suggestions! ... View more