I have a weird issue with the TA-pfsense TA. I can get logs in for about half a second and then they just mysteriously stop. A packet trace shows the logs are still being sent and the port is remaining open. splunkd.log has something interesting though: 01-12-2020 17:25:30.970 +0800 WARN DateParserVerbose - A possible timestamp match (Sun Sep 9 09:48:25 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=udp:5016|host=pfsense_hostname|pfsense| Any ideas please? ... View more

Hi all, It doesn't matter how much I read the documentation https://docs.splunk.com/Documentation/StreamApp/latest/DeployStreamApp/ConfigureFlowcollector or follow tips from https://answers.splunk.com/answers/636437/how-to-configure-the-splunk-flow-collector-setup-i.htmlhttps://answers.splunk.com/answers/743408/streamfwd-is-not-forwarding-netflow-v9-data-to-sh.html I can't get the TA to ingest netflow from pfSense 2.4.4. I have pfSense using the sotftflow package exporting netflow ipfix to my combined SH/Indexer (single instance, home setup) on port 9995. I have the Splunk UF installed on pfSense and it is configured to use a deployment server if needed. I have SE running on Ubuntu 16.04 v 7.3.1 with Splunk Stream 7.1.3 installed as the app and with the TA. I have the following configs: /opt/splunk/etc/apps/Splunk_TA_stream/local/inputs.conf: [streamfwd://streamfwd] splunk_stream_app_location = https://splunk-enterprise/en-US/app/splunk_app_stream disabled = false index = netflow [streamfwd] disabled = false source = stream [udp://9995] connection_host = ip source = stream index = netflow disabled = false /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf: [streamfwd] port = 8089 ipAddr = 127.0.0.1 netflowReceiver.0.ip = 127.0.0.1 netflowReceiver.0.port = 9995 netflowReceiver.0.decoder = netflow UDP 9995 and TCP 8089 are listening and working fine. I'm hitting walls here. I have no idea what's wrong or whats happening next. Unusually I get this in streamfwd.log: 2019-08-11 11:16:35 ERROR 140695607523072 stream.CaptureServer - Unable to ping server (19a246f1-d41e-472d-8de4-d42bcfc74f65): /en-US/app/splunk_app_stream/ping/ status=303 I can confirm that /en-US/app/splunk_app_stream/ping/ does not exist... but I have installed from the tgz so I am not sure why it doesn't exist? Sorry, this is all over the place, as is my config, such is my desperation to get this working. Please help. ... View more