Hi, please can you share how exactly were you monitoring the share  If you can share how it was mounted and then how you configured the UF to see the share/file Was is just normal add data and monitor a local file ( which was the mount actually) ? thanks ... View more

Sir, I have been a fan of yours for long. Thank u for all the knowledge sharing. I have " missing FWs in Splunk Ent or ES reported by MC that I can not clear any more via the "Rebuilt Forwarder assets" feature in MC. Any advice is appreciated in advance. Thank u ... View more

Hello, does restarting Splunkd is necessary after deleting the checkpoint file (pointer)? Thanks.   ... View more

Check my add-on up the thread. I can push the code to some public git so that more people can work on it and make it better. https://splunkbase.splunk.com/app/5116/ ... View more

I converted this to an answer. Please mark it as the correct one. ... View more

I have this same issue and also get results from this command with no errors ... View more

Pretty sure that link is regards to having the Splunk server (script or some modular input) be able to go out to the internet via a proxy server. If you are putting a proxy server in front of splunkweb (for something like SSO) you should take a look at the web.conf.spec file for the appropriate settings. ... View more

Hi, thanks for your reply. We only want to collect firewall events that match the following action types: "action=drop,reject,block". Just configuring the input for firewall events will also collect "action=allow" and other action types, events that we don't need and that, by volume, kills our enterprise license in about 8-9 hours. Also, the fact that on every connection we are downloading everything, puts an extra load on the Splunk server, as we have to filter the events on indexing time. As said previously, doing a quick props/transform job works, but it would be nice to have more configuration flexibility as we had on previous versions. Regards 😉 ... View more

The new version of the add-on, version 4.0.0, was released on Monday! You can download it here: https://splunkbase.splunk.com/app/3197 You can find documentation here: http://docs.splunk.com/Documentation/AddOns/latest/OPSEC-LEA/About This version supports Splunk Enterprise 6.4, Check Point R80, and the SHA256 certificate. This version replaces the older version. If you have an older version, you need to remove or disable the previous version before installing the new version. ... View more

You can get Unix data with a Windows indexer without problems, but you can't use the graphical interface to configure the Unix and Linux Add-on. Just go into the add-on folder in windows explorer, copy the splunk/etc/apps/Splunk_TA_nix/default/inputs.conf to splunk/etc/apps/Splunk_TA_nix/local/inputs.conf and enable the options you want. ... View more