Sorry, can You please explain better which web interface? ... View more

Better solution for me has been finally (filtering and) making data segmentation at Intermediate Forwarder level this way ..... ( for instance I put all sourcetype syslog into my_index) in props.conf [syslog] TRANSFORMS-index-my_index=overrideindex-syslog in transform.conf [overrideindex-syslog] DEST_KEY =_MetaData:Index REGEX = . FORMAT = my_index this way no file is to be pointed but the sourcetype. Configuration is working for all UF deplyed. Multitenancy is served. ... View more

New DB connector feature is called "Identity": identity links an identity to a Splunk's user, but authentication is not available on a Free License, i.e. a License Master is needed to work with more than one connection. Also DB connections con be asssigned to a specific index, i.e. the DB Connector nodes needs to be indexers, so if the node is a Free Trial license, it is limited to 500 MB/day. ... View more

I solved operating at a UF level as suggested by Giuseppe and Odonio. Question about why the index use at a IF tier did not work still remains open as I asked originally, but I go further! tanks! Maybe because index assignment (index=my_index) cannot be done before indexing and IF does not index. ... View more

Architecture scale fast horizontally and solve some "political" questions upon Customers. It depends on the needs. ... View more

Hi Giuseppe, me too perform filtering at Intermediate level. Since Intermediate Forwarder is a complete Splunk instance (just configured as you said: forwarding+rerceiving, not indexing) this instance can concentrate many actions. One of this for me would like to be segregation on geographic base. The inputs.conf is on the Intermediate Forwarder too. I want everithing that comes to this node go into a specific index, when it will arrive to indexing tier. In Splunk Manual we see "Send events to specific indexes" Indexer Manual. I was trying this strategy. Transform for a specific source_type means defining a source_type, but I'm trying to have multitenant not segregation by source_type. I will go further and will report. Thanks a lot Giuseppe. ... View more

thanks adonio for your comments. For what I can see I have no choice, I have to operate at Forwarder tier. I have to good into deep about deployment server for sure in the future. ... View more

Hi adonio, index segregation should work but it does not work for me, something should be checked in my general architecture and configuration, and I'm wondering what.... Have a look to my comment to Giuseppe below also: my Intemediate forwarder does not perform indexing, because indexAndForward=false. So I'm wondering if the [input] index = my_index in inputs.conf is working in this condition. Also if I change indexAndForward=true, I doesn't make difference. Intermediate Forwarder has several advanages: 1-reduce security rules to send data out from Customer to Cloud 2-aggregate all filetring into one instance (optimization of licence consumption) 3-aggregate segregation rules to one instance (if it would work!!!!!! :-)) no need for a deploiment server at the moment. ... View more

I think this configuration below is suitable only for Universal Fw not for an Intermediate Forwarder. Actually I need to operate at an Intermediate Forwarder tier. If I have 100 hosts to monitor is not efficient fix 100 inputs.conf files. So I am wondering if is there any instance working for "all" data coming to the Intermedite Forwarder from a Group of host/Forwarders. The only way to do this I found in Manual and Answers is to operate with index = my_index but unfortunately is not working ..... ... View more

Hi Giuseppe, I have an Intermediate Forwarder in order to concentrate all filtering at that tier. So I have ......<-----INDEXER(S)<---------INTERMEDIATE FORWARDER<---------------UNIVERSAL FORWARDER(S) The Intermediate Forwarder doesn't perform indexing it's just like an Heavy Forwarder. this tier should only put all data coming from UNIVERSAL FORWARDER into my_index!! So i configured /opt/splunk/etc/system/local/inputs.conf with the proper input stanza. That is not working. ... View more

Thanks adonio: data comes to the indexer but into "main" index, not in the "my_index". Data segregation doesn't take place as configured. A search with index=* shows the events n the current time windows. It seems like the stanza is ignored. ... View more

It worked for me, thanks ... View more

I've got one dashboard for each user. "with own logo in an html header" this is a nice and simple solution Giuseppe, Thanks a lot, I was not thinking this way.... ... View more

I Tried : #### Windows:Security [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [secsetparsing2] REGEX=Administrator DEST_KEY = queue FORMAT = indexQueue [secsetparsing] REGEX=(?m)^EventCode=(528|529) DEST_KEY = queue FORMAT = indexQueue but still receive non Admin events altought REGEX=Administrator in Regex PCRE Standard means "every string that contains Administrator word". I suppose the filter is not working. Does exist a way to filter in the parsing queue on a field basis ? ... View more

Is the filter applied on source data of the event? ... View more

Thanks. But which is the regular expression that match the string "Nome utente: Administrator" in source data? I have this event (a classic Windows Security event): "02/02/2017 10:06:49 AM LogName=Security SourceName=Security EventCode=529 EventType=16 Type=Failure Audit ComputerName=server01 User=SYSTEM Sid=S-1-5-18 SidType=1 Category=2 CategoryString=Accesso/fine sess. RecordNumber=1549305796 Message=Accesso non riuscito: Motivo: Nome utente sconosciuto o password non valida Nome utente: Administrator Dominio: MyDomain Tipo di accesso: 3 ..." ... View more

thanks anyway for your suggestions ... View more

Thanx in advance.... The search generating the alert does not use any "| sendmail" command. I checked the search string opening "Open in search" on the alert list (correct?): "| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% di utilizzo"=round(used_bytes/quota*100,2) | fields Pool "% di utilizzo" | where '% di utilizzo'>64" this query is used to fire an alert when license usage goes over 64%. No sendmail command is here. Alert is configured in the App seacrh. But there is no alert_actions.conf in App search I suppose it uses the system conf. All alert_actions.conf files are /opt/splunk/etc/apps/alert_logevent/default/alert_actions.conf /opt/splunk/etc/apps/alert_webhook/default/alert_actions.conf /opt/splunk/etc/system/local/alert_actions.conf /opt/splunk/etc/system/default/alert_actions.conf Anyway using btool for system config, all seems o be correct as for the Report......still investigating.... ... View more

thanks two times, this way I could add the "os" specific index in the USER1 role. Bye. ... View more