Hi, did you try disabling forwarder monitoring and then enabling it again? That removed missing forwarders from the monitoring console for me. ... View more

Yeah, that works partially. Is there a way to extract automatically al data in fields of the type: <Data Name="fieldname">value</Data> Those do not get extracted when piping through xmlkv, only the value for the last "Data" field gets extracted as you can see on your picture. ... View more

We had a crash on the ESX containting one of our Splunks that caused a sudden reboot and was facing this same error (latest Opsec lea plugin). Solution worked great! Thanks ... View more

Hi, did you try restarting the universal forwarder service on the remote servers? ... View more

I'm having problems downloading from the renewed splunkbase using Internet Explorer 11 (corporate browser). However, using Chrome everything Works as expected. Did you try with a different browser? ... View more

Hi, It downloads the results from the scans without deleting them. ... View more

Did you configure a proxy for the add-on to get plugin information? If so, it will try to connect also to the Nessus instance via that proxy. If the Nessus interface is not reachable through that proxy, then it will fail to connect. ... View more

Any reason to use 6.3.4? You may try the newer builds: 6.3.6 or 6.4.2 and see if it works. ... View more

Just create a new props.conf file with the desired configuration in $SPLUNK_HOME/etc/system/local/ on your indexer. Make sure to restart Splunk to apply the changes. ... View more

Hi, thanks for your reply. We only want to collect firewall events that match the following action types: "action=drop,reject,block". Just configuring the input for firewall events will also collect "action=allow" and other action types, events that we don't need and that, by volume, kills our enterprise license in about 8-9 hours. Also, the fact that on every connection we are downloading everything, puts an extra load on the Splunk server, as we have to filter the events on indexing time. As said previously, doing a quick props/transform job works, but it would be nice to have more configuration flexibility as we had on previous versions. Regards 😉 ... View more

I didn't go for this path at first as this way we are actually downloading all events from the CMA while in previous version we only downloaded the filtered events. So it would be nice to be able to keep doing that, just to reduce network traffic between the CMA and Splunk. Meanwhile, applying this solution works until we can apply filters to the collecting process 🙂 #props.conf [opsec] TRANSFORMS-drops = opsecnull, opsecparsing #transforms.conf [opsecnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [opsecparsing] REGEX = (drop|reject|block) DEST_KEY = queue FORMAT = indexQueue ... View more

Up&Running! Thanks 🙂 ... View more

Yeah, just got one firewall in the process of being replaced for a Check Point and we are currently running 6.4. Hope the update comes out soon. ... View more

Got the same problem with the subject of events ingested from a Fortimail appliance. This script worked perfectly. Thanks 🙂 ... View more

Just fired up a x64 unix vm with Splunk 6.4.0 and now it works 🙂 ... View more

Hi, I get the following errors on browser console: appLogo.png:1 GET http://splunkdev:8000/en-GB/splunkd/__raw/servicesNS/admin/splunk_app_addon-builder/static/appLogo.png 404 (Not Found) jquery-2.1.0.js:8556 GET http://splunkdev:8000/en-US/custom/splunk_app_addon-builder/app_home/app_list?_=1461740753049 500 (Internal Server Error) And then this on web_service.log: KVException: Failed to POST https://127.0.0.1:8089/servicesNS/nobody/splunk_app_addon-builder/storage/collections/config, reason=Service Unavailable which brings me down to the fact that the KV store is only supported on x64 OS (I'm running the DEV instance on my local computer with Windows 7 x86) 😞 "KV store is available and supported on all Splunk Enterprise 64-bit builds. It is not available on 32-bit Splunk Enterprise builds. KV store is also not available on universal forwarders." Is the KV Store functionality required by the add-on? If so, maybe a simple warning "add-on only supported under 64-bit operating systems / splunk builds" should be added to system requirements. Guess I'll have to fire up a VM with a x64 OS 🙂 ... View more

Well, the problem did not reproduce again after downgrading the affected servers to 6.2.6. However, I have another Splunk instance with different servers with 6.3.0 installed and this problem does not happen there. I'll keep installing 6.2.6 for now on new deployments. ... View more

Yeah, it's totally random... I just did a downgrade to 6.2.6 (we went 6.2.5>6.3.0>6.2.6) to see what happens. Today splunk uf totally bogged down two database servers. ... View more

We are having this problem on some servers. It does actually happen on the same day and time every week since we upgraded our UF to 6.3.0, so we are currently trying to narrow down the reason. In any case, this did not happen with 6.2.5... maybe we'll downgrade some UF's to 6.2.6 and see what happens. ... View more

You can get Unix data with a Windows indexer without problems, but you can't use the graphical interface to configure the Unix and Linux Add-on. Just go into the add-on folder in windows explorer, copy the splunk/etc/apps/Splunk_TA_nix/default/inputs.conf to splunk/etc/apps/Splunk_TA_nix/local/inputs.conf and enable the options you want. ... View more