Hi @Amira , as you can read at https://splunkbase.splunk.com/app/2770, this addon is supported by Splunk. as you can read at https://docs.splunk.com/Documentation/AddOns/released/CitrixNetScaler/Install , You have to install this add-on on HF under conditions. I usually install all add-ons both on HFs and SHs to support index time parsing (HFs) and search time parsing (SHs). Ciao. Giuseppe ... View more

Hi @Amira , you have to install the Splunk Add-on for Citrix NetScaler also on the Heavy Forwarder. Then you have to create the index on the Indexer and  you must be sure that data are stored in the correct index. Ciao. Giuseppe ... View more

Hi @masakazu , did you followed all the instructions in the above link? I never exerimented the above issue. My hint is to repeat all the steps in the installation procedure, checking if you have kv-Store issues in your Splunk installation. If you don't solve, open a case to Splunk Support. Ciao. Giuseppe ... View more

Hi @Utkc137 , sorry, but you're receiving logs from BlueCoat using syslog or from another Splunk Forwarder? usually BlueCoat uses syslogs not a Splunk Forwarder. splunktcp inputs is for log forwarding from another Splunk system not using syslogs! Ciao. Giuseppe ... View more

Hi @Ben , you should change the grants in the apps containing the other dashboards. Then, how do you created the new role? did you created by scratch or cloning another one or did you used an inheritance? Don't use inheritance. Ciao. Giuseppe ... View more

Hi @rahusri2 , as I said,you can install a Splunk Heavy Forwarder and configure it exactly as the on-premise receiver. Then, to forward data to Splunk Cloud, you have to download from your Splunk Cloud instance the Forwarders app and install it on the Heavy Forwarder, otherwise it cannot send logs to Splunk Cloud. Ciao. Giuseppe ... View more

Hi @Utkc137 , sorry for the very stupid question: did you restarted your Splunk server after conf update? Could you share the inputs.conf you are using? Please thy this: [bluecoat] TIME_FORMAT=%Y-%m-%d %H:%M:%S TIME_PREFIX=^ rename=bluecoat:proxysg:access:syslog [bluecoat:proxysg:access:syslog] TIME_FORMAT=%Y-%m-%d %H:%M:%S TIME_PREFIX=^ pulldown_type = true category = Network & Security description = Data from Blue Coat ProxySG in W3C ELFF format thru syslog KV_MODE = none SHOULD_LINEMERGE = false EVENT_BREAKER_ENABLE=true MAX_DAYS_AGO = 10951 TRUNCATE = 64000 in local/props.conf Ciao. Giuseppe ... View more

Hi @Utkc137 , then, where do you located the add-on? it should be in the first HF data passed through or (if HFs aren't present) in the Indexers. Ciao. Giuseppe ... View more

Hi @Utkc137 , did you tried with the sourcetype "bluecoat"? that should be the one you assigned to your input. Ciao. Giuseppe ... View more

Hi @Utkc137 , there's a priority in conf files reading and in that add-on there are some tranformations, so probably the sourcetype you added isn't present when the local file is read and created after using a transformation, see the default sourcetype and try adding your configuration to this sourcetype. Ciao. Giuseppe ... View more

Hi @rahusri2 , let m,e understand: you have a Forwarder (UF or HF) using the outputs.conf you shared to forward logs to Splunk C loud that receives syslogs (using UDP on port 8125), is it correct? At first my hint is to not using Splunk as receiver but an rsyslog (or syslog-ng or SC4S) to receive syslogs because in this way, you can continue to receive syslogs even if Splunk is down. Then you can us an UF or an HF to read these files and forward them to Splunk Cloud.ù In addition, you could have at least two (or more) UFs to receive syslogs with a Load Balancer in front to have a real HA and don't lose data. But the error you have is probably another one: to send logs to Splunk Cloud from a Forwarder, you have to download an app (called forwarder) from your Splunk Cloud instance, containing the certificates and the passwords to conne ct to Splunk Cloud, you cannot send logs without it. for more infos see at https://docs.splunk.com/Documentation/Splunk/9.3.2/Data/UsingforwardingagentsCloud Ciao. Giuseppe ... View more

Hi @rickymckenzie10 , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @smallwonder , when you say limit the amount of data, are you meaning: limiting the files to read or filter events? if limiting the files to read, you can add whitelist and blacklist options to your inputs.conf. If instead you want to filter sone data, you have to identify one or more regexes to filter your logs (positive or negative filtering), and then apply the method described at https://docs.splunk.com/Documentation/Splunk/9.3.2/Forwarding/Routeandfilterdatad Remember that these filters must be applied in the first full Splunk instance they are passing through, in other words on the first Heavy Forwarder present or on Indexers, not on Universal Forwarders. Ciao. giuseppe ... View more

Hi @PolarBear01 , the only way to have HA at Forwarders level is to have two or more Receivers (rsyslog or syslog-ng or SC4S) , so your receiver will work even if Splunk is down; with a Load Balancer that distributes syslogs between them and manages fail over. Receivers can be located on UFs or on Hfs, I usually use rsyslog on UFs! I don't know what you mean with manual balancing, for a real HA, you need a Load Balancer that  works without any manual action. There's also the possibility to configure DNS for load balancing and fail over managing, but DNS usually responds with a delay in case of fault of one receiver, so you loose first logs, for this reason a real Load balancer (e.g. F5) is the best solution for a real HA. The HFs are useful if you want to concentrate all logs before to send them to Splunk Cloud, otherwise (on premise) it isn't mandatory. Ciao. Giuseppe ... View more

Hi @arjun , multi tenency  implementation isn't a Community job and it requires an analysis and a design by a Splunk Architect. You should define rules to identify customers and assign to each of them an index overriding the default. So first job is to identify rules (regexes) and then apply on your Heavy Forwarders (if present) or on your Indexers something like this: # transforms.conf [overrideindex_customer1] DEST_KEY =_MetaData:Index REGEX = . FORMAT = customer1_index # props.conf [host::customer1_host] TRANSFORMS-index = overrideindex_customer1 Ciao. Giuseppe ... View more

Hi @Rak , good for you, see next time! let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @SamYap , you have to see in one props.conf and transforms.conf what you are forwarding. You can recognize the tranformation because it will contain the option: DEST_KEY = _SYSLOG_ROUTING as you can see at https://docs.splunk.com/Documentation/Splunk/7.2.3/Forwarding/Forwarddatatothird-partysystemsd?_gl=1*1rvxpty*_gcl_au*MjEyMTY3MjIyOC4xNzMwMTI3ODI0*FPAU*MjEyMTY3MjIyOC4xNzMwMTI3ODI0*_ga*MTg5Nzg2MDQyNS4xNzMwMTI3ODI1*_ga_5EPM2P39FV*MTczMzIxMTcyOC4xNjguMS4xNzMzMjExODY0LjAuMC43Mjg5Nzc5NTA.*_fplc*dmw3anNTNFVJVHlscHljOG9URVFjZEtrUU5henVOdjhIeHdYN3ltcVd3WkR4em9WbWNOcFYzZEs2d3clMkZHZGkwTkpSNkVmOFBCb3IycVVVQXpvallUWWFkSUslMkY1UkZ6NEtvQkRHZ21yTSUyRmIwOWl4cXVCR1BlZlRzbmJQYzFRJTNEJTNE#Syslog_data Ciao. Giuseppe ... View more

Hi @tdavison76 , please try this regex: | rex field="alert.message" "On-Prem - (?<your_field>[^\"]+)" that you can test at https://regex101.com/r/RWQr9a/1 Ciao. Giuseppe ... View more

Hi @tdavison76 , I could be more detailed if you could share some sample of your logs, anyway, if you want to take all the content of the "alert.message" field after "On-Prem - ", you could try: | rex field="alert.message" "\<\=On Prem - (?<Name>.*)" Ciao. Giuseppe ... View more

Hi @Sailesh6891 , it's a best practive to create a custom add-on containing all the parsing rules for your data, also because I suppose that there are other parsing rules that you need to add. but anyway you can also put this two lines in another props.conf. Ciao. Giuseppe ... View more

Hi @Sailesh6891 , did you tried to use LINE_BREKING option in props.conf? [your-sourcetype] LINE_BREAKING = ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Ciao. Giuseppe ... View more

Hi @anooshac, you have to coalesce the key fields and then correclate them using stats: if the fields to correlate are field1 and field2 and the fields to display are field3 and field4 from the type1 and field5 from type2 index=your_index sourcetype=your_sourcetype type IN (type1, type2) | eval key=coalesce(field1,field2) | stats values(field3) AS field3 values(field4) AS field4 values(field5) AS field5 BY key Cao. Giuseppe   ... View more

Hi @alec_stan , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @inessa40408 , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Hi @alec_stan , Splunk hasn't any kind of clustering at Forwarders level, you have to configure your DS to deploy the same configurations to all the HFs.   ... View more