Thanks, I answer without testing and now i can say that you are right. Have you try a HF to do this change? Regards, ... View more

Hi, Maybe a easy way to correct this problem is set 12 sedcmd with all possible months: SEDCMD-AGOSTO = s/^ago/8/ SEDCMD-SEPTIEMBRE = s/^sep/9/ ..... ... View more

Have you check the _indextime to check if the event is new? Hope i help you ... View more

Hi, But this is what it does... if you use this part: | rest splunk_server=* /services/shcluster/status |fields peers*label |transpose |table column "row 1" |rename "row 1" as label |append [ rest splunk_server=* /services/shcluster/status | fields peers*status |transpose |table column "row 1" |rename "row 1" as status] You will see that add the to tables in one. Then I extract the ID without .label and .status |rex field=column "[^\.]+.(?<id>[^\.]+)" And then with the stats I "join" both in one. |stats last(label) as label last(status) as status by id ... View more

Hi, Probably your syslog service in the heavy forwarding is adding info to the events. Have you try to send directly to hf by tcp port? Hope i help you ... View more

this regex doesn't capture nothing... use mine 🙂 ... View more

Hi, Thinking... if you configure all the indexes.conf in the peers, the changes will not take effects after you restart, so it will be fine if you configure all the indexes.conf with a small retention and then from the master make a cluster-bundle. The master will deploy the configuration, in your case nothing... but will control the restart of the indexers. But you should think in use master-apps to deploy these files in the future. hope i help you. ... View more

Hi rakesh_498115 Where exactly did you configure the index in the peers? system/local ? You should distributed the indexes.conf like a master-app To distribute configurations across the peer nodes: 1. If distributing any indexes.conf files, configure them so that they support index replication. See "Configure the peer indexes in an indexer cluster". 2. Place the files in the $SPLUNK_HOME/etc/master-apps directory on the master. The set of subdirectories in this location constitute the configuration bundle. 3. Use Splunk Web or the CLI to distribute the configuration bundle to the peer nodes. For details on these steps, see "Update common peer configurations and apps". http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Managecommonconfigurations ... View more

Hi, You didn't create this index with a master-app??? Where did you configure this index? You don't need to create any script, splunk can do a bundle and control the restart all of the peers, just modifique the configure in the master-app and make a bundle. ... View more

Hi, Have you thought to set a minimum retention of this index to 1mb? and do a cluster-bundle. Regards ... View more

system local configuration persist over ALL ... View more

And your stanza is [WinEventLog:Security] OR [WinEventLog://Security] Becouse the first one is incorrect ... View more

Other silly question... what versión of universal forwarder are you running? If you still have problems use my method 🙂 ... View more

Hi, Here you have a good example https://answers.splunk.com/answers/335000/how-could-i-filter-network-firewall-data-using-a-f.html#answer-335003 Hope help you ... View more

index=_internal ... View more

So, you should have also the key of the certificate. How they generate this certificate? ... View more

Hi, no. 1.- you generate the .key 2.- with the key you generate a certificate request .cer 3.- your company CA sign your .cer and give you de public CA and a certificate .pem Then you configure splunk. 🙂 ... View more

Hi, sure Here is the procedure https://wiki.splunk.com/Community:SplunkWeb_SSL_3rdPartyCA But the main thing is that you first have to generate the .key before get the pfx in the procedure that i posted. Hope i help you ... View more

Sure, With my command i match all the characters less the last one in a new field called no_last ... View more

Hi, You need generate the key. https://www.sslshopper.com/article-most-common-openssl-commands.html Here is the procedure https://wiki.splunk.com/Community:SplunkWeb_SSL_3rdPartyCA Hope i help you ... View more

Hi, I think that you should put the values in the xml in the same way, (case sensitive) Hope i help you ... View more