Hi @Praz_123 , in addition I don't find the add-on the you used in splunkbase, which one did you used? a custom one? probably the sourcetype is assigned is in the add-on. Ciao. Giuseppe ... View more

Hi @Praz_123 , the @richgalloway 's answer should answer to your question. In addition I could say also that, if you need to upgrade many clients and you have a Deployment Server, you could use the "TA - Splunk UF Upgrade Automation for Windows" ( https://splunkbase.splunk.com/app/8802 ), but only from the next upgrade because it runs from the 9.0 version. Ciao. Giuseppe ... View more

Hi @Praz_123 , At first: was the stopped data flow running some days ago or did they never arrived? let me understand: do you need an help to create an alert to know when a data flow stops or do you need an help to understand why the data flow stopped? Ciao. Giuseppe ... View more

Hi @0xAli , for my knowledge, the first connection is from UF to DS. Then, during the normal activity, is the DS that calls the UFs with the polling frequency that you configured. So I usually request to open bidirectional connections. Ciao. Giuseppe ... View more

Hi @erikwie , are you using the Splunk_TA_nix add-on to ingest these logs? did you enabled inputs on this add-on (by default they are all disabled)? Ciao. Giuseppe ... View more

Hi @splunkreal , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @splunkreal , I never tried but I suppose that you need it and in addition: "In order to open a Cisco Technical Assistance Case (TAC), you must have a support contract or product under warranty." Ciao. Giuseppe ... View more

Hi @splunkreal , if you try to access another Cisco app (eg. Cisco Security Cloud) and you log in in splunkbase, you can see the contacts for Cisco Support. this is the content of Cisco Security Cloud app Contacts: Contact Notes Cisco provides round-the-clock Technical Assistance Center (TAC) support. Please create a support ticket specifically related to the Cisco Security product integration. Ensure you specify whether the issue pertains to the product API, the core application, or the Splunk search/platform configuration. Contact TAC by Phone Enterprise and Service Provider Products US/Canada 1 800 553 2447 1 408 526 7209 Cisco Worldwide Support - https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html Create a TAC case - https://www.cisco.com/c/en/us/support/docs/instructions-guides/220312-open-a-tac-support-case-for-fast-dedica.html Setup Documentation - https://www.cisco.com/c/en/us/td/docs/security/cisco-secure-cloud-app/user-guide/cisco-security-cloud-user-guide.html Otherwise try this: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html Ciao. Giuseppe ... View more

Hi @splunkreal , if this add-on is Splunk Supported, you can open a case to Splunk Support: on the Customer Portal or in the Partner Portal depending on who you are. Ciao. Giuseppe ... View more

Hi @_Raj , you can follow the url indicated by @livehybrid anf find all the ways to ingest Windows logs. In my experience: avoid syslog because it modify the log format and the Splunk_TA_Windows doesn't recognize fields, so you have to parse them manually. I'd say also avoid WMI because isn't efficient and requires a Domain account. Only UF remains, but you don't want it! I'd suggest to analyze the advantage to use UFs (there are many advantages!), eventually with the support of a qualified Splunk Partner that can show you why UF is the preferred solution. Ciao. Giuseppe ... View more

Hi @AceX , there will be a new on the Community (probably here. https://community.splunk.com/t5/Splunk-Tech-Talks/bg-p/splunktechtalks/label-name/featured) in few days so you can sign up. Let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @AceX , the url isn't still available, the date is July 30th at 9:00AM PST/12:00PM EST, but i still haven't a more detailed agenda. Ciao. Giuseppe ... View more

Hi @AceX , as I said, there isn't any documentation, official and not official! I found many works for this reason! Ciao. Giuseppe ... View more

Hi @AceX , the dashboards customization isn't a so easy job, but anyway it's a secondary job! The main jobs are: separate indexes, customize Customer's ingestions configurations, modify all Detections, customize interface (Mission Control) Customize all Dashboards, create a custom app for Customers, modify Threat Intelligence framework, modify Asset and Identity Management Framework, Create custom Response Plans. As i said, you need someone that already did it! ... View more

Hi @AceX , You can separate customers data in different indexes but this isn't the solution, it's onlyu the first step of the job. Anyway, you cannot separate notables indexes. In addition, you have to customize the ES interface, Detections, Threat Intelligence, Asset and Identity Management, and add a Customer interface to access data. Ciao. Giuseppe ... View more

Hi @AceX , I will describe the process of ES multitenancy implementation in the "Splunk Community Champions Lightning Talks" that will be the 30th of July. There isn't any official or not official documentation about it. I don't know your knowledge of ES, but anyway, it isn't an activity that you can do by yourself, it's better to be performed by someone that already did it! it's a job for Splunk Professional Services that already did it. Ciao. Giuseppe ... View more

Hi @AceX , ES isn't multi-tenant, but it's possible to configure it for multitenancy and I did it for many italian SOC as a Service companies. It's a big job with a duration of two-three months. Indexes must be separated, users' roles must be customized and there are many action to be performed on ES. Ciao. Giuseppe   ... View more

Hi @cdCryptoMetrics , let me understand: you want to send Splunk Cloud data to a third party system, is it correct? at first I don't understand what you mean with "using SPL with Collect Command" because the collect command is used to store search data in an index and not to forward data. Anyway, if you want to send data arrived from on-premise systems to  third party system, you could do this on the Heavy Forwarders that you should have as concentrator in your on-premise infrastructure. For my knowledge there isn't any other solution. Ciao. Giuseppe ... View more

Hi @e_v_m , let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @e_v_m , I am agree with  @VatsalJagani , at first I'd check if it's possible to upgrade the HF, mainly not because its old but because it's out of support so you cannot ask help to Splunk. If you need a temporary solution, you could use an intemediate HF with an higher versione of Splunk, but in this way you don't solve the main issue: you have a very old system in your architecture and data continue to pass through it. Ciao. Giuseppe   ... View more

Hi @0xAli , good for you, see next time! let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @0xAli , about the first assumption, it isn't correct: Schedule Mode (Continous or real-time) determine the type of the Scheduled Search(RTScheduled Search OR Historical Scheduled Search) historical scheduled Search can be operate at the Continuous mode ot the Real-time mode ? historical scheduled Search are in Continuous Mode, not in RT Mode, what's the sense of a RT historical search? A Real-time scheduled Search always uses Real-time scheduling by nature? yes Ciao. Giuseppe   ... View more

Hi @709_miner , ask the Forwarder License to the Splunk Cloud Support. Ciao. Giuseppe ... View more

Hi @0xAli , is is clear for you or do you need other information? Ciao. Giuseppe ... View more

Hi @0xAli , about first question: in Splunk a search takes a CPU (more if you have also subsearches in the main search) until it will finish, so a RT search takes one or more CPUs for always, it's better to schedule a search so it will release the CPUs when finised. About second question: No RT depends on how you configured your detections: scheduled or RT, as I said if you can avoid RT, otherwise give more resources (CPUs to your Indexers and Search Heads)! On Splunk Cloud RT searches are usually blocked for all not admin users! Ciao. Giuseppe ... View more