Hi @AL3Z  did you fix the issue, i am also facing the same issue. ... View more

Thanks for the response. we do not want downtime, please find the below steps on  Old Splunk indexers All the data is ingesting(storage path) in the default location  (/opt/splunk/var/lib/splunk) Has CM New Splunk Servers 1. Prepare 3 New indexers and a New CM 2. On New Indexers Storage path for Hot & warn data is /splunk_hot and /splunk_cold Plan for Migration from old to New (without down-time) Build a New Cluster Master Build 3 New Indexers with storage paths as (/splunk_hot and /Splunk_cold) Create the symbolic link on the old Indexers with the same Name New indexers storage path ((/splunk_hot and /Splunk_cold) Example : ln -s /opt/splunk/var/lib/splunk/…..    /splunk_hot (I am not sure here) Change the path in config in indexes.conf on old Cluster Master [volume_primary] #Path = /opt/splunk/var/lib/splunk  (this is old path and it is committed) Path = /splunk_hot [volume_cold] #Path = /opt/splunk/var/lib/splunk  (this is old path and it is committed) Path = /splunk_cold Push the bundle from the old CM. Join the New indexer server to the old CM. (This will sync the data) Wait till all the data is sync Move the Old CM config to New Cluster Master Shutdown the old CM Last step make the old indexers offline enforce count. I am Struck here I want to create a symbolic link on old indexers servers, how could I create and point the hot data to move in /splunk_hot  and colddb  to /splunk_cold I can see in the old indexers they are lots on index available (like windows,Linux,security,waf,firewall) ... View more

i have , just connect DBconnect with SQL DB, i have not executed any Query's and no changes yet in inputs ... View more

Hi, Try this add-on  for symantec Messaging gateway  https://splunkbase.splunk.com/app/5215/   ... View more

i cannot download the add-on ... View more

@thambisetty  Bluecoat proxy version 6.7   format : "date","time","time-taken","c-ip","cs-username","cs-auth-group","s-supplier-name","s-supplier-ip","s-supplier-country","s-supplier-failures","x-exception-id","sc-filter-result","cs-categories","cs(Referer)","sc-status","s-action","cs-method","rs(Content-Type)","cs-uri-scheme","cs-host","cs-uri-port","cs-uri-path","cs-uri-query","cs-uri-extension","cs(User-Agent)","s-ip","sc-bytes","cs-bytes","x-virus-id","x-bluecoat-application-name","x-bluecoat-application-operation","x-bluecoat-application-groups","cs-threat-risk","x-bluecoat-transaction-uuid","x-icap-reqmod-header(X-ICAP-Metadata)","x-icap-respmod-header(X-ICAP-Metadata)" ... View more

Hi, we are forwarding W3C ELEF format from Bluecoat proxysg to syslog-ng. we have notice on syslog-ng server  bluecoat logs are not having log headers. please see the log sample   Aug 9 12:00:00 10.0.xx.xx 2020-08-09 09:00:00 1 10.xx.0.10 aaxxxx yyyDomain\xcyv%20XXXXXXX%20Internet%2Group 10.0.xx.xxx 10.0.xx.xxx None - - OBSERVED "Youtube;Audio/Video Clips" https://www.youtube.com/ 200 TCP_HIT GET text/plain https r6---sn-4wgd.googlevideo.com 443 /videoplayback ?expire=15969881&ei=nbEvX9yLA4OWWMuDg5AO&ip=98.220.xx.xxx&id=oAJ4JFOEDAszlxnibA285uN6_lOZUonUhoyA44Rb2mE6&itag=396&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278%cccv%2C395%2C396%2C397%2C398%2C399&source=youtube95390&req_id=53b73fd85edb82c5&altitags=395%2C394&rn=541668&rbuf=0 - "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/10.0.0.xxx Safari/537.36" 10.x.x.000 2113 1530 - "YouTube" "Play Video" "Video Hosting" 2 a954beb9a-00000000b2ac6060-000000005f2fbb10 - - ... View more

Hi ikulcsar, i am looking for forcepoint Email Security Add-on, Hope you have successfully done the parsing (Add-on), Could you please help me in this thanks ... View more

please find the logs : Apr 3 03:14:48 133.22.00.00 2019-04-03 07:14:48 74 10.130.122.151 Jastaniahfm aljfs\Group%20Internet%20Basic www.google.com 172.217.19.132 None - - OBSERVED "CRM-Access;Search Engines/Portals" https://www.google.com/ 204 TCP_NC_MISS POST text/html https www.google.com 443 /gen_204 ?atyp=csi&ei=-VekXNPyG66PlwT_hZDYDg&s=newtab&t=all&action=update&conn=onchange&ima=1&ime=1&imeb=0&imeo=0&wh=618&scp=0&net=dl.1650,ect.4g,rtt.150&mem=ujhs.10,tjhs.11,jhsl.2330,dm.8&sto=&sys=hc.4&rt=xhr.342,aft.4,cst.0,dnst.0,rqst.70,rspt.21,rqstt.21,unt.21,cstt.21,dit.159&zx=1554275688237 - "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36" 133.22.00.001 306 1429 - "none" "none" "none" 1 7ee0b471858c027d-00000000228366b2-000000005ca45d68 - - Apr 3 03:14:48 103.33.33.3 2019-04-03 07:14:48 68 10.0.51.51 Karimykd aljfs\Group%20Internet%20No%20Restriction ctldl.windowsupdate.com 10.111.000.241 None - - OBSERVED "White list website;Non-Viewable/Infrastructure" - 304 TCP_MISS GET application/vnd.ms-cab-compressed http ctldl.windowsupdate.com 80 /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab ?5fae3ccb4e56dcf8 cab "Microsoft-CryptoAPI/6.1" 10.22.22.22 386 322 - "Microsoft Update" "Update Software" "none" 1 7ee0b471858c027d-00000000228366af-000000005ca45d68 - "{ %22expect_sandbox%22: false }" ... View more