Hello,  Are there searches or any log files that will tell me what is being forwarded from my heavy forwarder?  I have a multi site, clustered splunk environment that ingests all its own personal logs first but then sends all of the data to a third party via a heavy forwarder and data diode. I do not have access to the data once they have been sent from the HF so i cannot assess what has been sent.  Are there any splunk techniques, searches, log files i can view from my heavy forwarder to determine what data have been sent to the data diode?  I can provide config files if required.  ... View more

hello,  i am trying to send wineventlogs from my machines to my clustered indexer and also send the same event logs but in Xml format to a heavy forwarder for third party.  my inputs.conf looks like this [WinEventLog://security] disabled = 0 index = xxxx renderXml = false [WinEventLog://security] disabled = 0 renderXml = true _TCP_ROUTING = heavy1 my outputs.conf is the following [tcpout:group1] indexerDiscovery = idxc1 autoLBVolume = 65536 [indexer_discovery:idxc1] master_uri = https://serverip:serverport pass4SymmKey = xxxx cxn_timeout = 300 [tcpout:heavyforwarder] defaultGroup = heavy1 [tcpout:heavy1] server = serverip:serverport does anyone know why it now does not send to my clustered indexers? know that i did put _TCP_ROUTING = group1 under the non Xml event logs in inputs.conf and still didnt work.  cheers in advance ... View more

Hello,  I have an index cluster and would like to send ALL data to a non splunk third party end point. is this possible? this is the props.conf however for an index cluster where should i configure these files?  the second configuration is the transforms.conf the final configuration is the outputs.conf [syslog] TRANSFORMS-routing = routeAl [routeAll] REGEX=(.) DEST_KEY=_TCP_ROUTING FORMAT=Everything [tcpout] defaultGroup=nothing [tcpout:Everything] disabled=false sendCookedData=false server=10.1.12.1:10514  my concern is that i actually just want to forward all of my data. is there a particular configuration needed for this? or any ideas?  many thanks  Willsy ... View more

Hello, i have what i believe is a basic search and what should work however it doesnt seem to display anything when i search for it. Effectively what i want it to do is, when you type in X number that will pass into the search as X_token and then search for the number you have just input. could i have some guidance on this please. Covid_19 <input type="text" token="X_token" searchWhenChanged="false"> <label>Enter X number for individual information</label> </input> <panel> <table> <search> <query>index=* $X_token$ | table "X number" "First Name" Surname "Mobile Number" Cell Role</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> ... View more

I am trying to map my datacentre cabinet heat locations to their respective cabinets on a top down view of the datacentre using visio. Is there a way to map my temperature to the correct rack location without using Lat/Long? ... View more

Hello, how do you send cisco device health (temperature, CPU usage, memory usage etc) to splunk? currently all my syslog data for my network devices go into my syslog server and the splunk load balancer to then go into the clustered indexers. i have looked at SNMP modular input add-on, read their guides, etc but i think i am missing something. https://www.splunk.com/blog/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt1.html https://www.splunk.com/blog/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt2.html can you.... send snmp data to the syslog server, then from there get splunk indexers to either monitor the file OR send the file to splunk from the syslog server? any help is greatly appreciated ... View more

hello, Our physical servers had to restart and as such the splunk servers dropped. we are now having issues on our cluster master and our indexers. our deployment looks like this, DCAXXXG013 CM and LM DCAXXXG014 IDX DCAXXXG015 IDX DCAXXXG016 IDX DCAXXXG017 SH DCPXXXG013 DS DCPXXXG014 IDX DCPXXXG015 IDX DCPXXXG016 IDX DCPXXXG017 SH The indexers on site A and Site P are both clustered. just wondering if anyone can shed some light on where to go and how to progress from here if possible. Search peer DCAOVSG016 has the following message: Failed to register with cluster master reason: failed method=POST path=/services/cluster/master/peers/?output_mode=json master=dcaovsg013:8089 rv=0 gotConnectionError=0 gotUnexpectedStatusCode=1 actual_response_code=500 expected_response_code=2xx status_line="Internal Server Error" socket_error="No error" remote_error=Cannot add peer=172.26.10.49 mgmtport=8089 (reason: non-zero pending job count=1, guid=ADA4AE8A-B93F-48E2-88CC-F47CDDCB9AE4). [ event=addPeer status=retrying AddPeerRequest: { _id= active_bundle_id=EDA5C78B2096F563800873D7CBD2A6DF add_type=ReAdd-As-Is base_generation_id=2073 batch_serialno=1 batch_size=3 forwarderdata_rcv_port=9197 forwarderdata_use_ssl=0 last_complete_generation_id=2077 latest_bundle_id=EDA5C78B2096F563800873D7CBD2A6DF mgmt_port=8089 name=ADA4AE8A-B93F-48E2-88CC-F47CDDCB9AE4 register_forwarder_address= register_replication_address= register_search_address= replication_port=9100 replication_use_ssl=0 replications= server_name=DCAOVSG016 site=site1 splunk_version=7.2.0 splunkd_build_number=8c86330ac18 status=Up } ]. Indexer Clustering: The search process with sid=rt_scheduler_admin_QkNOX1RBX1dpbmRvd3MtU2VydmVycw_RMD5d0958093cdddf4f3_at_1551270120_1818 on peer=DCAOVSG014 may have returned partial results due to a reading error while waiting for the peer. This can occur if the peer unexpectedly closes or resets the connection during a planned restart. Try running the search again. Learn more. 2/27/2019, 12:22:34 PM Search peer DCAOVSG014 has the following message: Failed to register with cluster master reason: failed method=POST path=/services/cluster/master/peers/?output_mode=json master=dcaovsg013:8089 rv=0 gotConnectionError=0 gotUnexpectedStatusCode=1 actual_response_code=500 expected_response_code=2xx status_line="Internal Server Error" socket_error="No error" remote_error=Cannot add peer=172.26.10.47 mgmtport=8089 (reason: non-zero pending job count=2, guid=3724715E-6BAC-46F9-AFE7-06917EF3FD3C). [ event=addPeer status=retrying AddPeerRequest: { _id= active_bundle_id=EDA5C78B2096F563800873D7CBD2A6DF add_type=ReAdd-As-Is base_generation_id=2086 batch_serialno=1 batch_size=2 forwarderdata_rcv_port=9197 forwarderdata_use_ssl=0 last_complete_generation_id=2093 latest_bundle_id=EDA5C78B2096F563800873D7CBD2A6DF mgmt_port=8089 name=3724715E-6BAC-46F9-AFE7-06917EF3FD3C register_forwarder_address= register_replication_address= register_search_address= replication_port=9100 replication_use_ssl=0 replications= server_name=DCAOVSG014 site=site1 splunk_version=7.2.0 splunkd_build_number=8c86330ac18 status=Up } ]. Any help is greatly appreciated. Cheers ... View more