I setup half a dozen serverclasses leveraging CMDB sourced .csv and whitelist.from_pathname This works great to managing serverclasses with thousands of clients, though I was surprised these serverclasses whitelisted clients would get stale unless I'd issue a reload deploy-server / reload deploy-server -class Couldn't find any flag on the DS allowing whitelist.from_pathname to update whenever the linked .csv would update. Is there any better way ? ... View more

Running on Splunk 8.08 Even though we already have ITSI setup to recognise dozens of different performance related data sources, IT Essentials Learn shows "Use Case Families were not found." on its homepage and doesn't offer any macro configuration  Both of the only 2 scheduled searches the App offers are erroring out "Telemetry: ITE Procedure Stats" is erroring with "Error in 'eval' command: Type checking failed. 'OR' only takes boolean arguments." on the below code snippet | eval [| rest /servicesNS/nobody/splunk_instrumentation/telemetry | table telemetrySalt | format | rex field=search mode=sed "s/[()]//g"] | inputlookup ite_procedure Likewise for "Telemetry: ITE Procedure Usages" is erroring out on | eval [| rest /servicesNS/nobody/splunk_instrumentation/telemetry | table telemetrySalt | format | rex field=search mode=sed "s/[()]//g"] ... View more

I have a requirement to push a subset of universal and heavy forwarders originating data to a third party, for which I enabled a set of HFs for data forwarding alone. This is working fine, as data arrives uncooked to a target syslog-ng . The troublesome part was being asked to ensure the HF resends the data in case the target undergoes maintenance, or has an outage lasting up to 2 days. Considering Persistent Queues don't work over splunktcp streams, is it even an option for me to push uncooked data to the HFs, enabling a standard TCP input (not splunktcp ) with Persistent Queue enabled, say, to 200GB? Never heard of anyone using this approach. Would this work? ... View more

According to https://docs.splunk.com/Documentation/AddOns/released/MSSQLServer/SQLServerconfiguration Audit events get written into a binary file C:\SQLAudit which then gets read via a DB connect query. This is problematic when we need to monitor hundreds of different MSSQL Server DBs and would imply us setting up several HFs just for this tech stack alone (as well as very infrequent ingestion queries which doesn't seem a great fit for ES) Even though writing audit events via Windows Event Log is less performsnt as it implies using the Windows event API rather than outputting to a file I don't see any other option for us other than doing it and fetching via UF This seems to have been the legacy approach for older TA versions https://answers.splunk.com/comments/170572/view.html ... View more

As in, hypothetical scenario If the CM goes down overnight and it takes forever (eg. 10h) for a standby CM to manually takeover/same CM to be recovered from a VM snapshot but all indexers happily stay up (and able to contact each other), is there any chance a scheduled search not finding some primary buckets ? ... View more

How would we ensure data persistence/queuing when using Ryan Faircloth's (or a similar script) method to batch the syslog messages using a script rather than the default one message per POST of syslog-ng's http() output ? Scenario is if there's an 1h network outage between syslog-ng and the HEC HWFs https://www.rfaircloth.com/2017/02/10/building-perfect-syslog-collection-infrastructure/ ... View more

How to correct this SPL to avoid this error index=win EventCode=528 OR EventCode=4624 LogonType=2 | fields Account_Name [ | inputlookup identities_1 | inputlookup append=true identities_2 | inputlookup append=true identities_3 | rename identity as Account_Name | fields Account_Name watchlist | where watchlist = "true" ] Error in 'fields' command: Invalid argument: 'Account_Name=HELP' ... View more