Hello, we are on splunk 6.5.1 (same versione for the forwarder; unfortunately we can't upgrade at the moment). We installed the forwarder on a Windows machine, and we configured deployment.conf to talk with the deployment server, like this: [target-broker:deploymentServer] targetUri = deployment.ourdomain.ext:80 From the forwarder logs, we see that this error is showing up: 02-24-2022 12:19:54.474 +0100 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected The communication with deployment.ourdomain.ext seems to be working (telnet works; the DNS is transforming calls to port 80 to port 8089 of the deployment server). Why is the forwarder giving that error? We restarted it many times, but with no result. Thanks   ... View more

Hello, we have 4 search heads on our installation of Splunk 6.5.1, with DBConnect 2.4.0. Suddenly, all the search heads started feeding data into Splunk via DBConnect, while, some days ago, only one of the search heads per time was executing the scheduled query and writing on the database. What can we check to avoid this behavior (that puts 4x data on the index)? Thanks ... View more

Hello, I'd like to understand if it's possible with any Splunk version, preferably version 6 or later, to implement this type of behavior: - Send and email only the first time the alarm condition is met. If the alarm (scheduled with the "cron" method) triggers again the next time, don't send any email - Send an "end of alarm" email, after an alarm fired, when the alarm condition is not met anymore Thanks. ... View more

Hello, Salesforce is becoming the global leader in CRM/Sales services, but Splunk doesn't seem to have a "certified" or "official" solution to index Salesforce events/log data/etc. The only app for Salesforce/Splunk integration is "TA-SFDC", that is highly unsupported and unreliable (we've tested it). Is Splunk planning for a solution to index cloud (Salesforce in particular) data? Thanks in advance. ... View more

Hello, we've set up a transforms.conf filter in one of our forwarders (to lower indexed volume per day), but the configuration is not working (events are not filtered out). Log lines (events) we want to exclude look like this: 26/06/2012 18:24:31 | ReadLstOfValTable | INFO | Numero di record estratti [1] We have configured transforms.conf and props.conf like this: props.conf [SiebelDataADP] TRANSFORMS-null= SiebelDataADPFiltro1 transforms.conf [SiebelDataADPFiltro1] REGEX = .*Numero\sdi\srecord\sestratti\s.* DEST_KEY = queue FORMAT = nullQueue Any hints? Thanks Gabriele ... View more