I would also say if you are standing up brand new (which it seems you are not though) it is worth noting that setting the cluster configuration to multisite in the front end 'multisite = true' this will allow you to in the future more easily flip the switch to merge the two and have the Splunk allocate the data across the newly added indexers. This will allow for you to add the new site and have the data re-balance across the newly linked indexer nodes. ... View more

One solution to this would be to on the syslog-ng server utilize buckets.d and patterdb.d in order to write the cisco ASA logs to a directory and then from there, you can use a UF to monitor that directory and forward directly to the indexers. ... View more

[WinEventLog://ForwardedEvents] disabled = false start_from = oldest current_only = 0 checkpointInterval = 5 index = renderXml=false This seems to be working for us if you wanted to give it a shot. ... View more

DalJeanis, Thank you for the response but I am looking for something more along the lines of dynamically filtering results as stated if I type in "Cam," it will filter for results with "Cam" in it without having to kick off another search. Or am I wrong and with using "Cam" for example, this will somehow search without hitting enter and using that as a token in the postprocess search (after base search)? ... View more

Saurabh009, I would suggest using the Bonnie ++ and reading it within Splunk with the app itself. https://splunkbase.splunk.com/app/3002/ ... View more

Hello, I am unsure of how to add the correct FirstEvent and LastEvent time in, but for the search in which you are looking for, I would use a tstats command similar to below to return the desired results. To group every sourcetype by its index use the search below: | tstats count WHERE index=* by index sourcetype To group the sourcetypes by index use the below search: | tstats count values(sourcetype) WHERE index=* by index With this search it should populate your dashboard without a problem. You would just have to further investigate adding the first and last event times. ... View more

Some of the conflicts you would like to look for is for example, in the inputs .conf btool pull. You may have some files living in the $SPLUNK_PATH/etc/system/local directory, if this is the case the local directory will take precedence over the apps and not allow your apps inputs in this case to take effect because of the configuration file precedence. To see a detailed breakdown of the btool pulls something similar to below: $SPLUNK_PATH/etc/bin/splunk btool inputs list --debug This should show you the list of everywhere the inputs configuration files live that is built into the running Splunk config. https://docs.splunk.com/Documentation/Splunk/6.5.1/Troubleshooting/Usebtooltotroubleshootconfigurations ... View more

You might want to check the btool pulls you get from your various devices. You might have some conflicts with where you have installed the *nix apps. http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Wheretofindtheconfigurationfiles In the link above you can read where your apps are in precidence order. If you wish, upload a debug btool pull for your inputs and outputs files and post them here for further help. ... View more

Hello, As @richgalloway stated, this change should happen at the forwarder level, that is if you are using a Heavy Forwarder, if not then this will have to happen at the indexing layer of the pipeline. The format of your blacklist should be as below: blacklist = EventCode = 5156 Please reference the doc below for further information: http://docs.splunk.com/Documentation/Splunk/6.2.5/admin/inputsconf ... View more

Hello, If you are dig into the datamodel itself of 'Authentication' you will see two a subset of Authentication datamodels. In those you should see "Successful Authentication," Unsuccessful Authentication," etc. The subset names may not be exactly that but you should see those once you open up the 'Authentication' datamodel and poke around. Once you find those names, the search would be something along the lines below: |datamodel Authentication Successful Authentication search... Also, with your search, I would try to map back indexes to specific datamodels to improve overall performance. You can do this with the Splunk Common Informaton Model (CIM) Addon: https://splunkbase.splunk.com/app/1621/ ... View more

The version was not listed in your post, sorry. ... View more

You could create an additional role through access control for that particular user and now allow them access to Create New Dashboard. ... View more

Perfect thank you, the second one worked perfect! ... View more