Anyone using the Gemini KV Store Tools app (https://splunkbase.splunk.com/app/3536/)? If so, have you gotten the backup files retention to work?  This app was recommended to me by Splunk Support. According to the documentation, "Retention deletion takes place when running kvstorebackup."  But regardless of what value I use in the 'Age-Based Retention (Days)' field in the setup UI page, the backup files are never cleaned up.  I'd rather not use a cronjob to clean them up as our Splunk instance is IaC and instances/servers can be terminated/rebuilt at any time (meaning the cron tab would be lost). Thanks! ... View more

We're running v8.0.7.  We ingest syslog data through a cluster of servers running rsyslog and UFs.  I'm looking to install v2.6.2 of the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467/). Does anyone know if this TA requires the use of the Splunk Connect for Syslog app or can we use rsyslog (or syslog-ng) to accept syslog traffic? Thanks!   ... View more

I have a need to ingest certain SQL Server logs, in a proprietary .xel format, into Splunk. Do I need to somehow first get these logs into a common file type/format before ingesting them? If so, how would I do that? Thanks. ... View more

I'm configuring the DB Connect app (v3.1.1) with the SQL Server TA (v1.3.0) on a Heavy Forwarder (Splunk v6.6.5) in order to pull DMV data from our SQL environment. I'm using the default query templates. All of the queries return data to the HF. However, 5 of them send their data to the Indexers with no host value (only source and sourcetype). Sample Splunk event: 8/1/18 2:36:48.340 PM 2018-08-01 14:36:48.340, object_name="MSSQL$ABCQ1:Memory Broker Clerks ", counter_name="Pressure evictions (pages/sec) ", instance_name="Column store object pool ", cntr_value="0", cntr_type="272696576", max_connection="32767", DatabaseName="master", ServerName="SRVSQLVQ4\ABCQ1" source = sys.dm_os_performance_counters sourcetype = mssql:os:dm_os_performance_counters tag = database tag = performance Has anyone seen this before? Thanks. ... View more

I have a JSON log file that I'm attempting to ingest (Splunk v6.6.5). The events parse correctly, but the epoch time isn't being used as the event timestamp. Splunk is using the file modified date for the event timestamp. Here's a sample record and my props config (which lives on the Indexers): {"time":1531405028,"name":"PSIKD01.BOOT","appl":"@ABCVDIF","server":"SERVER1","user":"LSRVID","HandleCount":792,"KernelModeTime":66875000,"OtherOperationCount":18498,"OtherTransferCount":630163,"PageFaults":320216,"PageFileUsage":1349924,"PrivatePageCount":1382322176,"ReadOperationCount":36716,"ReadTransferCount":38844376,"ThreadCount":34,"UserModeTime":363281250,"VirtualSize":2207380942848,"WorkingSetSize":672907264,"WriteOperationCount":205,"WriteTransferCount":63855} [apm_json] KV_MODE = none INDEXED_EXTRACTIONS = json TIME_PREFIX = "time": TIME_FORMAT = %s SHOULD_LINEMERGE = false TRUNCATE = 100000 Any help would be appreciated. Thanks! ... View more

I'm trying to monitor a specific Windows Application EventCode (via a whitelist), yet the events are not being sent to Splunk. I've found numerous posts on the answers site, most of them with different configs, but I've yet to find one that works. What's stated in the documentation (http://docs.splunk.com/Documentation/Splunk/6.6.1/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27) does not work as specified. I've tried both of these stanzas with no luck: [WinEventLog://Application] disabled = 0 index = os_windows whitelist = EventCode="^3000$" [WinEventLog://Application] disabled = 0 index = os_windows whitelist = EventCode="3000" I'm running v6.6.1. Any help would be appreciated. Thanks. ... View more