Could you provide more information? It is not clear if you're saying Splunk is causing the issue or postfix. Do you believe Splunk is sending e-mails to your local postfix and that is filling the disk? You can check with the following search to see if Splunk is sending thousands of e-mails: index=_internal sendemail source="*python.log" and index=_internal sendemail source="*splunkd.log" to have an idea ... View more

Hey, your recommendation above is not supported neither recommended. The minimum number of instances to deploy Splunk on an Indexer Cluster will be 4 servers (2x indexers, 1x SH and 1x CM). Cluster Master is a relatively low resource server and you can use a smaller VM to accomplish that role. When you setup the Indexer Cluster and choose your instance type you can only chose one, that means you can't really have a CM and an Indexer together. If you just have two physical hosts, you might want to virtualise them and create separate instances on those physical servers. Just make sure you have enough resources if virtualising. You can read this paper: https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf ... View more

It doesn't make a lot of sense to do that as this data is online on Splunk and you're mainly looking to duplicate it. You can however backup Splunk data and keeps it outside of Splunk. More information about backup of Splunk data can be found here: https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Backupindexeddata ... View more

You can refer to this link here to reset the admin password: https://answers.splunk.com/answers/623691/splunk-admin-password.html If you're looking only to change your user preferences I don't see why you wouldn't be able to do so. What exactly are you looking to change? You can certainly click on your user name on the top of the Splunk screen and then on Account Settings or Preferences depending on what you're looking for. Hope this helps ... View more

I would say you need to check with whoever configured the LB. In general you can use tcpdump to monitor your syslog server and check for any packets arriving from the Load Balancer IPs on port 514 TCP. This might give you a confirmation that the LB is health checking the syslog server and therefore understanding it as down if no TCP connection is stablished. ... View more

I'd recommend you check splunk-launch.conf for the user, su to the user: su <user> and then run /opt/splunk/bin/splunk start and see what error messages it shows (if any) and please note I assumed Splunk is installed under /opt/splunk ... View more

Check inside splunk-launch.conf for SPLUNK_OS_USER then su to this user and start the Splunk service ... View more

Maybe you have a Load Balancer that health checks if TCP is working and if not it doesn't load balance the syslog traffic? ... View more

index=wineventlog sourcetype=* EventCode="672" OR "675" OR "676" OR "4768" OR "4771" | stats values(username) as usernames, dc(username) as user_num by src_ip | where user_num > 1 Above should work, just make sure there is a src_ip on your data otherwise change it to the desired IP field ... View more

Sure you can. You just need to change the Splunk Web Port. You can follow one refer to this doc: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Changedefaultvalues#Change_network_ports This answer help on that too: https://answers.splunk.com/answers/67/how-do-i-change-the-ports-that-splunk-listens-on.html ... View more

It makes sense but I don't know if that is a big concern. How much data per day are you talking about? I know I few customers that used this design to search various small locations between to 5GB to 50GB per day remotely. Not all data is transferred from the Indexers to the Search Heads. It also depends what kind of searches you perform from that central location. One other idea but I never tried, have multi-site clusters and not use SHC because you would need site affinity on the central location. Example: Asia has a multi-site index where it keeps one copy on the original site and send another copy to the remote site (central located indexer). The local SH in Asia would be site aware and only search in Asia (unless Asia indexer is down, in that case it would search central indexer). And then same thing for Europe, one indexer in Europe, one in central location. This way you would have 2 central located indexers, one in each multi-site cluster. Then you could use the central SH with site affinity, that way it would search only the central located indexers and only the remote indexers in case the central from that cluster is down. ... View more

Hi, For what you're describing you don't really need to index again all data on a centralised location, you can point your central SH or SHC to search all locations separately. Example you have an Indexer Cluster (or no cluster, doesn't matter) in Asia where you would index data from local servers and a SH local in Asia where you can search for that data, then another Indexer Cluster in Europe and same as Asia, and another in US (doesn't really matter where). Then on a central location you setup a Search Head or a SHC and configure it to join Asia/Europe/US Indexers Clusters or just configure the Indexers as Search Peers if not using Indexer Cluster. This way the central location will be searching all locations but the SH on each location can only search the local data. See this .conf slides about a similar deployment using ES: https://conf.splunk.com/files/2016/slides/enterprise-security-multi-tenant-fundamentals.pdf. Just use this as an example as the idea works with or without ES. Hope this helps. ... View more

Just to make it clear, are you talking the evals and field alias not working on the new transformed sourcetypes or on the old sourcetype (sophos:xg:sys). Is there any remaining events with that old sourcetype? Would be good to have a sample of your transforms.conf just for reference ... View more

Yes, otherwise you're doing an eval with no field matching your criteria ... View more

Hi, I would suggest you get a wildcard before and after the surnames that way the lookup entry would look like smith. To do that you can edit the ldapsearch query and add the following in the end: | eval Surname= "*" + Surname + "*" . That should add the wildcards on the lookup you're using to whitelist. Hopefully that helps ... View more

Hi, I have seen something similar if using cheaper storage for cold buckets. It would greatly reduces speed if the storage is slower. Also, how many events are you talking about? How many events in two weeks and what is the difference for 3 weeks? Using the date_wday is a bit tricky as not all events will have that field. This is created only when you have the timestamp on the event and it also doesn't change timezones. For more information about it, check here: https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/Usedefaultfields You might also be thinking about data model acceleration if you want better performance on searches over large sets of data and specially over large amounts of time. ... View more

Can you run that search and look at what results do you get from it? ... View more

If one interferes with the other yes you might have problems. See this link for file precedences: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Wheretofindtheconfigurationfiles You might also need to wait the knowledge bundle to be deployed to the indexers before you can see the configuration working (which might take a few minutes) ... View more

Hey, No the cluster master cannot be one of the Indexers, you'll need a separate instance for that. The Cluster Master is actually a very good candidate for a lighter virtual instance. More information about the cluster master can be found here: https://docs.splunk.com/Documentation/Splunk/8.0.1/Indexer/Systemrequirements#Additional_roles_for_the_master_node. You can deploy the cluster on Windows Server, see more information here: https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/Systemrequirements. Me personally prefer using Linux as Windows has general more overhead O.S. than Linux and some small issues that you'll find over time. I cannot see Windows 2012 specifically stated there, so you better go with a newer version of Windows server if you choose to. ... View more

Ohh sorry, so not following exactly why it doesn't work. What results do you get? Maybe you just want to display the Perc field, append this to the end of your search: |fields Perc ... View more

Try removing the hardcoded earliest=-15m latest=now as this overwrites the time you choose on the time picker ... View more

Without knowing all the details I'll try to answer: the su with the hyphen changes the user environment variables and without the hyphen it keeps the environment variables (more info here: https://superuser.com/questions/453988/whats-the-difference-between-su-with-and-without-hyphen). I believe it might be the case you didn't have permissions to read the file before and after su you kept that without the hyphen. Full su documentation is also available here: http://man7.org/linux/man-pages/man1/su.1.html. hope this helps ... View more

You will need to do it one step earlier, I'll need to change the correlation searches that generate the notables. Example you have a tstats correlation search, you would need to add something like values(sourcetype) as origin_sourcetype. Example below: Correlation Search concurrent login attempts detected (original search): | tstats summariesonly count from datamodel=Authentication.Authentication by _time,Authentication.app,Authentication.src,Authentication.user span=1s | drop_dm_object_name("Authentication") | eventstats dc(src) as src_count by app,user | search src_count>1 | sort 0 + _time | streamstats current=t window=2 earliest(_time) as previous_time,earliest(src) as previous_src by app,user | where (src!=previous_src) | eval time_diff=abs(_time-previous_time) | where time_diff<300 You could add the following: | tstats summariesonly count, values(sourcetype) as origin_sourcetype from datamodel=Authentication.Authentication by _time,Authentication.app,Authentication.src,Authentication.user span=1s | drop_dm_object_name("Authentication") | eventstats dc(src) as src_count by app,user, origin_sourcetype | search src_count>1 | sort 0 + _time | streamstats current=t window=2 earliest(_time) as previous_time,earliest(src) as previous_src by app,user , origin_sourcetype | where (src!=previous_src) | eval time_diff=abs(_time-previous_time) | where time_diff<300 ... View more