We have had this same issue in our environment.  The fix we have come up with is to create an app for the 4300X events that are specific to cisco:ftd where we parse out all the fields (you can use kvmode=auto for these, but some fields like url don't get extracted correctly since they oftentimes have '=' in the url string).   In order to address the other message IDs that match number/format with cisco:asa, we make a 'custom' app and update it each time we update Splunk_TA_cisco-asa.  In that app (we named it Splunk_TA_cisco-asa-ftd) we just copy over the /default/ and /local/ props.conf files and change the sourcetype declaration from [cisco:asa] to [cisco:ftd].  The other files (like transforms) aren't needed because splunk already has those definitions in the Splunk_TA_cisco-asa app, you just need to tell it to do all the eval/extract/transform/etc functions from props.conf for the other sourcetype.  If you use eventtypes, you should also update that. We updated Splunk_TA_cisco-asa/local/eventtypes.conf to use 'sourcetype IN (cisco:asa, cisco:ftd)' to address that issue in the 'standard' app. I know that seems like a lot of customization, but after doing the customization / upgrade a few times, it's not so bad.  🙂  ... View more

Hey, thank you for your answer. Unfortunately, I have forgotten what exactly this was referring to, but I think i got it sorted out, as i havnt heard anything else about it. Not sure what the fix was.    Thank you nonetheless.  ... View more

Same issue. +0000 ERROR ModularInputs [18816 TcpChannelThread] - Argument validation for scheme=proofpoint_tap_siem: killing process, because executing it took too long (over 30000 msecs). For me , i saw this was an OS issue. On Ubuntu the input works, the Redhat boxes dont so ..  ... View more

Having the SPLUNK_HOME/etc/.ui_login file on the host DOES make the banner go away (as noted in the linked articles above). We did a bit of testing (since some of our servers had the file and others did not)... Logging in with a LOCAL account (non-LDAP/SAML/etc) automatically generates the .ui_login file.  Once we logged in with the LOCAL account, the .ui_login file existed and the "First time signing in?..." banner was gone. ... View more

Hey! Since I was searching for this topic/solution, I'll just add what I think is the right solution for this case. To preserve the _time, host, source and sourcetype: (...) | collect index=main  output_format=hec   ------------ If this was helpful, some karma would be appreciated. ... View more

I'm sorry I missed your message. If you're still looking out for a workaround, please refer gurlest's response ... View more

Hi, Try following steps to clear out the memory so FMC logs start to flow again: Go to: /opt/splunk/etc/apps/TA-eStreamer/bin/encore Remove "A.A.A.A-8302_proc.pid" $ ps aux | grep estreamer pkill -9 -f service.py Restart Splunk services I hope it helps! With Regards ... View more

The cause of this is, when using an SH Cluster, you are suggested initially to use the flag for not overwriting lookups (preserve_lookups) - the issue is that in 5.0.1 the automatic lookups for the Windows TA changed from using sourcetype to using source (since sourcetype is being consolidated in the app). For more information on this change, see this article: https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/UpgradeFromEarlierVersions#Upgrade_saved_searches The solution to remedy this is to either: Update the lookup file manually on the SH members GUI via file upload, which is "windows_apps.csv" Update the lookup file manually on the SH members GUI via search (see this answer from woodcock https://community.splunk.com/t5/All-Apps-and-Add-ons/After-Updating-the-Add-on-for-Windows-receive-error-quot-Could/m-p/454989/highlight/true#M55987) ... View more

The only thing I can think to try would be to have two totally different, yet exactly the same 'setnull' stanzas in transforms.conf > setnullA for sourcetypeA and setnullB for sourcetypeB each with their own 'setparsing' as you have done already. ... View more

Thank you. I clicked the vote. 🙂 Do you know how to place the report last run date/time on the dashboard? Since the data is essentially static, and only as good as the last run. I would like to place the last run date so it's "Effective as of..." ... View more

@gurlest Thank you for the response, I will try the above given solution. ... View more

We were having a similar situation in our environment and the issue ended up being that the group in question lived in an Active Directory branch outside the defined groupBaseDN value. Once we added that branch to the groupBaseDN filter, access worked like a champ. Original Value: groupBaseDN = OU=Server_Groups,DC=Enterprise,DC=MyDomain,DC=com Updated Value: groupBaseDN = OU=Server_Groups,DC=Enterprise,DC=MyDomain,DC=com;OU=Access_Groups,DC=Enterprise,DC=MyDomain,DC=com ... View more