While ingesting data from 3rd party products, if syslog data is being indexed, does Splunk automatically strip the header? In Splunk documentation, it states that the following parameter must be used in inputs.conf: **no_priority_stripping = true | false (default: false)** Also, how do I verify whether the actual syslog data that is being ingested had headers in the original data or not? Considering, there were no headers being shown in Splunk. ... View more

I have a macro.conf file containing a macro with definition: definition = index="SOME_INDEX" AND sourcetype="SOME_SOURCETYPE" both of which dymanic from client side. The above macro is being used in eventtype.conf (inside TA) and a summaries macro in savedsearch.conf (inside App). Currently, the macros.conf is in TA and hence the App Inspect shows failure for App as it could not find the given macros.conf file. As per splunk practices, keeping a same macro file in both app and TA is not recommended. Also, there is another workaround of using role-based indexing which is a norm but we used macro-based workflow because of the following case: https://answers.splunk.com/answers/710778/how-do-you-use-macros-in-event-types-on-distribute.html What is the best practice implementation which should be implemented? 1) Using two macros.conf in App and TA (each having individual macro for savedsearch and eventtype) 2) Request App cert team to allow the scenario as App and TA would always be bundled together on client environment 3) Any other scenario which do not affect the finctionality as well passes Splunk certification? ... View more