@woodcock  #Splunk Remote Upgrader for Linux Universal Forwarders It's not working, please see below serverclass.conf even tried by adding targetRepositoryLocationPolicy under serverClass stanza [serverClass:push_force_del_pkg_uf] in the UF still it is copying the app under /opt/splunkforwarder/etc/apps folder but i want it to be in /tmp directory [global] targetRepositoryLocationPolicy = rejectAlways [serverClass:push_upg_pkg_app:app:splunk_app_uf_remote_upgrade_linux] [serverClass:push_upg_pkg_app] whitelist.0 = XX.XX.XX.XX [serverClass:push_force_del_pkg_uf] targetRepositoryLocation = /tmp/ whitelist.0 = XX.XX.XX.XX [serverClass:push_force_del_pkg_uf:app:SPLUNK_UPDATER_MONITORED_DIR]     ... View more

hello, Is there any good solution to the problem of cloning into multiple groups and receiving copies of data from the indexer, but not necessarily with precision? ... View more

Couldn't you theoretically deploy an app with a scripted input that would make changes to files in etc/system/local? Not saying this is the best method because if it fails you could brick the forwarder, but I would think it is theoretically possible if there are no other means possible. ... View more

Hi there, Kara here, Splunk Community Manager. Thanks for your reply, but if you have an additional question, I recommend posting a new question for more visibility.  Cheers! ... View more

Hello, None of the above statement hold true for me. Our VM's are hosted in GCP, and we have 3 SH member in the SHC and 3 IDX. The issue is observed only in 1 peer, while the other works fine. Tried the setting mentioned above. Also, removed and reconfigured the problematic SH. The issue persists. If anyone has resolved the issue, please suggest steps to resolve this issue. ... View more

The link didn't get me to an answer, but this one did: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Resolveorphanedsearches   Specifically this section https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Resolveorphanedsearches#Reassign_unshared.2C_orphaned_knowledge_objects ... View more

I was struck at the same point you were.  I did below and it worked for me. 1. Copy the dashboard Source Code - Go to your Dashboard, Click on edit and select Source from UI and Source and copy the entire code. 2. Create a new view - Go to Settings, Views - Add new - New View - Paste the source code and give it a name ex: testing 3. Now go to Settings -> User Interface -> filter your app -> click on default  add line <view name="testing" default='true' />   ... View more

Documentation on these limitations can be found here: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTTUT/RESTandCloud And in case you haven't done this before, the link to file a case with Splunk Support can be found here: https://splunkcommunities.force.com/customers/home/home.jsp ... View more

I think the only option is to use the api to get the results and create the .xls file. In python, it should be easy. If you have access to the api and want help to develop this, I can make an example. ... View more

This worked perfectly, thanks 🙂  ... View more

Is there a reason you don't just send to different IP ports? [//tcp:10514] connection_host = IP sourcetype = bluecoat:proxysg:access:file index = web #assumes Palo Alto firewall [//tcp:10515] connection_host = IP sourcetype = pan:traffic index = firewall ... View more

Are you changing the hostname field in the Splunk code or is this configurable? I thought, "Host Name" on Forwarder Management page, was hostname shortname set in inputs.conf, even if you configured host=$decideOnStartup and hostnameOption = fullyqualifiedname for Windows. But it is not. The Host Name in Forwarder Management is the same as you would get using the hostname shell command in both *nix and Windows. It is very useful to see the real hostname together with Client Name (which is either GUID by default or coming from deploymentclient.conf) and Instance Name (which is serverName in server.conf). Also, if you edit clients in a Serverclass, you will see something called DNS Name. It is equivalent to DNS response on Deployment Server e.g. using shell command nslookup <hostname>. (The Deployment Server does a reverse lookup using the IP address of the incoming TCP packets. If it fails, DNS Name will have the IP address instead.) I have not seen any proper documentation of all these different names anywhere, so this is an area with lots of misunderstandings. Servers with Forwarders installed on easily gets incorrect host name and serverName once servers are cloned or renamed, which happens all the time. It can easily be a mess. ... View more

Hi champ,   thanks for the post, just wondering if you could reference a search that's not created and run in JS and stop it amid searching? I.e. you have a search in xml, how do you reference it using Search Manager in JS.   many thanks again, Derek ... View more

If you are trying to route data to multiple sets of indexer you want using the routing and filtering options of the HF. Here is the the Splunk Doc - Route and filter data ... View more

This has already been suggested in a comment by @bmacias84 but I think it deserves separate answer. Assuming fixing certificate issue is not an option: import ssl _create_unverified_https_context = ssl._create_unverified_context ssl._create_default_https_context = _create_unverified_https_context service = client.connect(...) ... View more

My post has nothing to do with format. It simply states that you can use the rest endpoint post your date. That endpoint is https://:/services/receivers/simple. ... View more

@tnerker - Would you be able to provide the answer your issue so that others can know what you did and we can close out your question? ... View more

Excellent thank you! I figured there was a built in way to do this. ... View more

This is super simple you just need to create your transforms and update the props.conf. I recommend you read Routing and and Filter data http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Routeandfilterdatad. This needs to be done on the indexer or heavy forwarder. #Transform [PIX_Index] DEST_KEY = _MetaData:Index FORMAT = PIX REGEX = %PIX-\d-\d{6} [FWSM_Index] DEST_KEY = _MetaData:Index FORMAT = FWSM REGEX = %FWSM-\d-\d{6} [ASA_Index] DEST_KEY = _MetaData:Index FORMAT = ASA REGEX = %ASA-\d-\d{6} Now update your props.conf. #props.conf [source::tcp:514] TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm,PIX_Index,FWSM_Index,ASA_Index [source::udp:514] TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm,PIX_Index,FWSM_Index,ASA_Index [syslog] TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm,PIX_Index,FWSM_Index,ASA_Index ... View more

its working nw thanks a lot @adambloom 🙂 ... View more

Hi @dwillsey - You should be seeing a banner up top that says your post is being moderated. But I will report this since we've been dealing with a bug related to this. Thanks for your feedback! 🙂 ... View more

Very interesting, thanks for that acharlieh The way I sorted this was identifying that what seemed like random gibberish in the full stderr and stdout paths, actually included executor/app_name and thus I was able to set a 1 to 1 relationship of source wildcard to sourcetype Still, very helpful insight, thanks again ... View more

Solution Found!!! https://codereview.stackexchange.com/a/179542 =) ... View more

Splunk can determine the number of available CPU's, however you may wish to run more searches per CPU. max_searches_per_cpu can be tweaked as required, I've run in excess of 10 searches per CPU without issue but it would depend on your workload... In my particular case most of the searches are carefully written and therefore I can have a higher number of searches per CPU. ... View more