I have a Syslog collector receiving logs from multiple Syslog devices and writing them in a directory-structured log file. The same host runs as my HF. One of those .log files, I want to read using [monitor] and send to a specific indexer (10.20.30.40:9998) where others continued to be read by their respective monitors and sent to one of the indexers as chosen by indexerDiscovery (some configs in my below outputs are missing but that works as that's not the issue). the issue is - I am facing difficulty in onboarding logs from this .log file, however, I am getting the internal logs of the HF which means there is no networking issue. below are my configs, any correction in them would be highly appreciated. inputs.conf ---------------------------------------------------------- [monitor:///var/log/splunk/Checkpoint/*/*.log] disabled = 0 Sourcetype = cp_log index = index1 host_segment = 5 # _TCP_ROUTING = isolationGroup [monitor:///var/log/splunk/Checkpoint_sys/*/*.log] disabled = 0 Sourcetype = cp_log index = index1 host_segment = 5 props.conf ---------------------------------------------------------- [cp_log] TRANSFORMS-routing = isolationRouting transforms.conf ---------------------------------------------------------- [isolationRouting] REGEX = .* DEST_KEY = _TCP_ROUTING FORMAT = isolationGroup outputs.conf ---------------------------------------------------------- [tcpout:my_indexers] clientCert = /opt/splunk/etc/auth/my_certs/my_serverCert.pem indexerDiscovery = MyIndexersDiscovery useACK = true [tcpout:isolationGroup] server = 10.20.30.40:9998   ... View more

The Splunk app AbuseIPdb_check (https://splunkbase.splunk.com/app/4903) is not working as expected after copying the config.json file to this app's local directory and putting my AbuseIPDB API key. I have tried with syntax as below - | makeresults | eval ip="94.201.237.206" | abuseip ipfield=ip | makeresults | eval ip="94.201.237.206" |abuseip(ip) The error on Splunk web is -- Error in 'script': Get info probe failed for external search command 'abuseip'.  i did not find anything relevant as a pointer when checked in Splunk _internal logs for this.  Under all configuration "abuseip" is mentioned as config type - command with enabled status and global sharing permissions.    Has it worked for anyone? any direction/solution pointer would be appreciable.   ... View more

Oracle Linux 7.5 Splunk Core 7.2.5 Alert Name -- DMC Alert - Critical System Physical Memory Usage The alert works on below rest command which pulls 2 fields from systems --- mem and mem_used.  | rest splunk_server_group=dmc_group_* /services/server/status/resource-usage/hostwide we have learned that this alert is giving false value after confirming from oracle support.  as per them, when running "free -m" command - "In Oracle Linux 7/8, the focus should be on the "available" column. The available column estimates how much memory is available for starting new applications without swapping. If, the system still has 28G available memory and you see 26G  in "used" - that is because this is how Linux behaves. Linux treats the memory that can be made available upon request as "used"."  also see - -   https://www.redhat.com/sysadmin/dissecting-free-command So, I am interested to fetch the "available memory" field from hosts.  So that I can do some eval and then optimize the existing alert to suit fit to our needs.  Is there any way, how to pull the "available memory" field from hosts? ... View more

How to integrate oracle idam suite with Splunk ? Any pointer would be highly appreciated. ... View more