I had the same problem and I could get rid of that error by renaming "federated.conf.spec" file from $SPLUNK_HOME/etc/system/README path. Please upvote if this helpful. Thanks, Mitesh. ... View more

The sample tutorial data in the Splunk docs website doesn't have what OP is seeking. Generally, the Splunk EDU courses provide that data on remote system, however, like OP, whenever we try to practice the labs 'after' completing the course, we do not have all the sample data sourcetypes with us. I completely agree with @Upas02 that, Splunk should either use the TutorialData from Splunk Docs during the Virtual/Classroom training or make Splunk Edu data samples available to public for practice. ... View more

I check with local teams and they do not have sufficient knowledge and setup to demonstrate the working model. I am trying but running out of Kaspersky trial license limit. If you are still interested, I can invest to rebuild another AWS instance to try it out. ... View more

@KasperskyLab: Any plans to release a working copy of app including the scripts and sample data? We have prospect customers who are looking out for Kaspersky TDF and Splunk Enterprise Security integration. Appreciate if you can upload the full version to Splunkbase. Thanks, Mitesh. ... View more

Well the documentation does not mention any particular setting on Splunk side. The local support folks do not have sufficient knowledge of any of the 4 options (Syslog, ArcSight, Qradar & Splunk) present in the latest Kaspersky Security Console. I have setup KSC and Splunk on AWS to try this out. Running out of trial license since I am not able to give full time to the setup. Will rebuild another instance if the problem statement is still open and anyone is interested in the solution. ... View more

In that case, you need to redefine your inputs.conf to point to corrected props.conf with json st. ... View more

Internally, Splunk would store new set of data with _json st, however, the search time interesting fields will list it as json in your case. ... View more

You will find Sourcetype Renaming option in Settings --> Fields menu path. Select the Destination App and provide the name of current sourcetype, _json in your case, and the new sourcetype as json and click Save. Hope this helps. Regards, Mitesh. ... View more

I took off the macro from the search that was powering the panel. Unsure why it was in place. ... View more

The macro came with the app itself. 🙂 I will try to tweak the macro to see if it works. ... View more

It doesn't matter how frequently you choose to receive the events within the 24-hour window, the license will still get consumed for that day. The only way to keep data ingestion within license limits is, to filter unimportant events from coming in. ... View more

Seems your command is incomplete. The documented syntax of the command is ./splunk package app <app_name> and it must be run from outside the <app> folder. Please vote the answer if this works for you (I am in need of karma points to post my question). Thanks, Mitesh. ... View more

I am facing the same error on freshly installed Splunk 6.5.0 on Windows 10 x64. My install is a standalone trial for exploring new features and does not have commercial Enterprise license or domain environment. Any idea if this error has major implication or safe to ignore in this case? Appreciate the help. Regards, Mitesh. ... View more

Did you copy the inputs.conf file from Proxy1 to the other two systems? If so, change the host = Proxy1 stanza on the other 2 systems with their respective hostnames and restart Splunk/UF service. ... View more

Have you tried crcSalt= in inputs.conf? Is that something you are looking for? Here is the link to Docs Search results (http://docs.splunk.com/Special:SplunkSearch/docs?q=crcSalt) that might give more info about it's use and limitations. Hope this helps. ... View more