@sheamus69  I've made some progress.  Initial work is getting the log ingestion from syslog and overriding the SourceType. Here is my inputs.conf   [monitor:///var/log/$mask_host1$/syslog] disabled = false #initCrcLength = 800 crcSalt = <SOURCE> index = test sourcetype = uag:syslog [monitor:///var/log/$mask_host2$/syslog] disabled = false #initCrcLength = 800 crcSalt = <SOURCE> index = test sourcetype = uag:syslog [monitor:///var/log/$mask_host3$/syslog] disabled = false #initCrcLength = 800 crcSalt = <SOURCE> index = test sourcetype = uag:syslog Here is props.conf on the HF. [uag:syslog] category = Custom TRANSFORMS-uag:syslog = vmware:uag:admin, vmware:uag:audit, vmware:uag:esmanager   Here is transforms.conf the HF. [vmware:uag:admin] REGEX = uag-admin\: FORMAT = sourcetype::vmware:uag:admin DEST_KEY = MetaData:Sourcetype [vmware:uag:audit] REGEX = uag-audit\: FORMAT = sourcetype::vmware:uag:audit DEST_KEY = MetaData:Sourcetype [vmware:uag:esmanager] REGEX = uag-esmanager\: FORMAT = sourcetype::vmware:uag:esmanager DEST_KEY = MetaData:Sourcetype   Next, I'll update with field extraction if you're intrested. ... View more

Could you please help me. Is there anything else I have to modify except inputs.conf. I have trouble getting data onboard.  ... View more

Have you resolved the issue. I have configured inputs config and see nothing. I saw this error in log file: HTTPError: HTTP 500 Internal Server Error -- {"messages":[{"type":"ERROR","text":"Cannot call handler 'SophosAddOnForSplunk_sophos_central_events' due to missing script 'SophosAddOnForSplunk_rh_soph os_central_events.py'."}]} ... View more

i am facing the same issue? anyone have fix for above issue? ... View more

According to Microsoft, events can be delayed up to 24 hours -> https://msdn.microsoft.com/en-us/library/office/jj984335.aspx#Data%20granularity,%20persistence,%20and%20availability So, it could be a delay in data availability from Microsoft. Or, it could be an error as well. Try the following search to see if there are any errors reporting back: index=_internal sourcetype=*ms_o365_message_trace* ... View more

Only way I know of how to do this is to set up hybrid search where a search head (the heavy forwarder?) is on premise and is able to search your Splunk Cloud indexers. Thus the alert can be set up on-prem and thus has access to first see the data to trigger the alert but also have access to your device in order to trigger the run of the script. That being said, this does require Splunk Support/Ops to set up. ... View more

Not yet, our team updated from exchange 2010 to o365 so now I have a whole new bag of issues. ... View more

That's right, the "pan_firewall" datamodel. Sounds correctly configured to me, and the data is clearly there since the admin user can see it. Sounds like a support ticket would help here, very interested to hear what you find out. ... View more

For future reference (as I'm asked a lot), the syntax is: Standard Apps: tar -zxf /some/location/splunk-db-connect_314.tgz -C /opt/splunk/etc/apps/ Deployment Server: tar -zxf /some/location/splunk-db-connect_314.tgz -C /opt/splunk/etc/deployment-apps/ I hope this helps with future us. ... View more

Hi JScordo, did you manage to get it working in the end? ... View more

Thank for letting us know this worked for you! ... View more

If you know the source names that you expect to see from the syslog server, you can easily use a metadata search and see what the lastTime value was for each source name. I like to use a regex filter to find only certain file names and then some time interval to wait. | metadata type=sources index=* | regex source="" | eval lt=now() - lastTime | where lt>300 Schedule this to run on a 5 minute (or whatever) interval you need to check. ... View more

Splunk Cloud does not presently support encrypted or signed emails. If this is a requirement, please contact your SE and ask him/her to file a feature request. If it must be secure, for now I'd recommend making API calls over the REST-API (https) to pull alerts from the management port. Keep in mind you need to file a ticket asking for the API to be opened up (port is blocked by default). You can specify a list of IP's for them to whitelist if you'd like (its an option). ... View more

I'm not sure of the differences with SplunkCloud. I would definitely get in touch with Splunk. ... View more

I know this is a bit old but you can monitor the iDRAC with the IPMI protocol. SNMP is great and all but finding all the OIDs is painful and you need to configure Splunk to collect SNMP. Using IPMI is a pretty simple scripted input. Some of the metrics you can pull with IPMI is Ambient Temp, CPU temp, fan speed, etc. Here is a video on how to set up and poll the iDRAC: https://www.youtube.com/watch?v=kaDMqczzwVs I hope this... JD ... View more

Before overwriting the default blacklist, can you let us know what the purpose of the original blacklist was? And what kind of performance issues (if any) this could lead to? ... View more