Hello, I am trying to bring a client's syslog data into Splunk using a universal forwarder (UF) on a syslog server. I am getting Splunk internal logs, and I am getting Linux logs off the box. The permissions seem to be set correctly and I am not seeing any errors in the Splunk internal logs. Any ideas of where I can go from here? My input stanza looks like the following: [monitor:///var/log/client_name] recursive = true crcSalt = queue = parsingQueue sourcetype = netscreen:firewall host_segment = 4 disabled = 0 Thanks, JG ... View more

Hello, I have a client who is insisting on building an on-prem Splunk environment with Windows Servers. Can someone tell me if Windows Server is a show-stopper for running ES? What functions won't work, or will have problems? Thanks, JG ... View more

Hello everyone! I'm trying to use props/ transforms to set a sourcetype and change the hostname of my devices. Currently they are coming in as sourcetype=syslog My event looks like this: Apr 3 22:37:36 10.77.265.178 1 1491277141.711671730 NAME_LOC_FW1 events Site-to-site VPN: notification INVALID-ID-INFORMATION received in informational exchange. I want to extract "NAME_LOC_FW1" and change the sourcetype to meraki as well as change the host to "NAME_LOC_FW1" I have the following props: [syslog] TRANFORMS-changesourcetypes = NAME_LOC_FW1 [syslog] TRANSFORMS-changehost = NAME_LOC_FW1_HOST And the following transforms: [NAME_LOC_FW1] Regex = (NAME_LOC_FW1) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::meraki [NAME_LOC_FW1_HOST] DEST_KEY = MetaData:Host REGEX = (?)(NAME_LOC_FW1) FORMAT = host::$1 This isn't working... Can anyone tell me what I'm doing wrong? Also, this is implemented on a Heavy Forwarder. Thanks a lot! JG ... View more

HI! I'm following the following directions to try and set up assets and identities for Splunk Enterprise Security on Splunk Cloud through a heavy forwarder. https://www.hurricanelabs.com/blog/gathering-ldap-identity-data-with-splunk-cloud The instructions say to set up a saved search on the Heavy Forwarder and have it populate a summary index. However, I am unable to schedule searches on the Heavy Forwarder and get the message: The search scheduler is disabled by the license Splunk is using. Scheduled searches that populate a summary index were found, but they will not be executed. This might affect dashboard panels that depend on the summary index. [!/help?location=learnmore.license.features Learn more] Does anyone have any tips on what I am missing? Thanks, JG ... View more

Hello, I have been trying for the last 8 hours to forward data to a Splunk Cloud instance. I generated the credentials off the Splunk Cloud instance as directed and attempted to use them on a heavy forwarder to no avail. I also tried a universal forwarder as well but it just won't work. I believe the problem is related to the credentials. One particular message I received was: 12-02-2016 19:27:20.156 -0500 WARN TcpOutputProc - 'sslCertPath' deprecated; use 'clientCert' instead 12-02-2016 19:27:20.156 -0500 WARN TcpOutputProc - 'sslCertPath' deprecated; use 'clientCert' instead 12-02-2016 19:27:20.156 -0500 WARN TcpOutputProc - 'sslCertPath' deprecated; use 'clientCert' instead 12-02-2016 19:27:20.156 -0500 WARN TcpOutputProc - 'sslCertPath' deprecated; use 'clientCert' instead 12-02-2016 19:27:20.156 -0500 WARN TcpOutputProc - 'sslCertPath' deprecated; use 'clientCert' instead I made a change to the config files to fix this, but it still will not work. In splunkd.log all I see is: 12-02-2016 19:38:59.726 -0500 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 12-02-2016 19:39:07.772 -0500 WARN TcpOutputProc - Cooked connection to ip=52.55.109.251:9997 timed out 12-02-2016 19:39:11.737 -0500 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 12-02-2016 19:39:23.739 -0500 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 12-02-2016 19:39:27.664 -0500 WARN TcpOutputProc - Cooked connection to ip=52.204.196.213:9997 timed out 12-02-2016 19:39:35.740 -0500 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 12-02-2016 19:39:44.356 -0500 WARN HttpPubSubConnection - Unable to parse message from PubSubSvr: 12-02-2016 19:39:44.356 -0500 INFO HttpPubSubConnection - Could not obtain connection, will retry after=84.982 seconds. 12-02-2016 19:39:47.553 -0500 WARN TcpOutputProc - Cooked connection to ip=52.44.41.196:9997 timed out 12-02-2016 19:39:47.740 -0500 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected Any ideas? Thanks, JG ... View more

HI, I have Splunk DB Connect install on a Splunk heavy forwarder. I am having trouble connecting to the database. The person who setup the DB has confirmed that the username and password are correct. I've used both the MS generic drive and the jDTS drive. Any tips or ideas of what to look at would be very helpful. I'm getting the following error: 2016-12-01T10:35:23-0500 [WARNING] [health_logger.py], line 162: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: Login failed for user 'MCEPO'. ClientConnectionId:52e2159e-2b3b-440a-a797-2320d4e549f7 Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\dbx2\health_logger.py", line 160, in do_log return func(*args, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\rh_connections.py", line 262, in get_connection_status raise Exception(msg) Exception: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: Login failed for user 'MCEPO'. ClientConnectionId:52e2159e-2b3b-440a-a797-2320d4e549f7 2016-12-01T10:35:23-0500 [ERROR] [rh_connections.py], line 230: exception com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: Login failed for user 'MCEPO'. ClientConnectionId:52e2159e-2b3b-440a-a797-2320d4e549f7 Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\rh_connections.py", line 226, in handleStatus status = self.get_connection_status(dbx2, fdb) File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\dbx2\health_logger.py", line 283, in wrapper return get_mdc(MDC_LOGGER).do_log(func, *args, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\dbx2\health_logger.py", line 160, in do_log return func(*args, **kwargs) File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\rh_connections.py", line 262, in get_connection_status raise Exception(msg) ... View more

HI! I am setting-up a heavy forwarder to forward data to Splunk Cloud. Do I just follow the instructions for setting-up a Universal forwarder to forward to Splunk Cloud? What address do I use as my recipient address? Thanks, JG ... View more

Hello, For some reason, when setting-up some heavy forwarders to accept syslog data on UDP 514, a colleague of mine ran the following command: Splunk add UDP 514 -sourcetype udp:514. This added the following stanza to %splunkhome%/etc/apps/search/local/inputs.conf: [udp://514] connection_host = ip sourcetype = udp:514 This is forcing sourcetype name "udp:514" on all the data that come in on that port. My question is, if I just remove the "sourcetype = udp:514", will all future data be assigned the correct automatic sourcetypes? Thanks, JG ... View more

Hello, Can someone tell me how I can change the ownership of scheduled searches in Splunk Cloud? Thanks, JG ... View more

Hello, Under security posture, all my notable events are showing 0 and I am not sure if it is working but we just haven't had a notable event, or if it isn't working. Can someone tell me how I can confirm that this part of ES is working? Thanks, JG ... View more

Hi! I have several windows hosts with the Universal Forwarder and Splunk_TA_Windows installed. they are feeding into a heavy forwarder and being forwarded to SplunkCloud. My Windows event logs from Splunk_TA_Windows are going into index "wineventlog". I would like to use a non-standard index. I've tried editing inputs.conf on the heavy forw3arder and also tried changing transforms.conf and props.conf to re-direct but have had no luck. Is it possible to make this change on the HF, or does it need to be made on each host? I'm getting the impression that changes like this to the Splunk_TA_Windows need to be made on each individual host. Can someone confirm this? If it is possible on the HF how can it be done? Thanks, JG ... View more