Hi, we configured retention policy based on the below parameters. However it doesn't work. There is no clue in the logs either. The Splunk is running on Windows Server 2012. User of the suplunkd proces has Full Control rights to the archive DIR. When the archive DIR was missing the frozen data were deleted along the frozenTimePeriodInSecs parameter. After adding the coldToFrozenDir parameter data are neither copied to the DIR nor deleted. Can anyone help please. [main] frozenTimePeriodInSecs = 15552000 coldToFrozenDir = D:\SplunkArchive Thanx Roman ... View more

Hi, can anyone please answere if it is possible to process ASA Built and Teardown messages of the single connection as a single event. ASA generates Built message when TCP/UDP connection established over the firewall and Terdown message when closing the connection. Unfortunately some data are missing in each type of message. (e.g. dirction is just in Built or duration is just in Teardown). What I what to do is process both messages for each connection as the single merdged "connection" event so that I can make a select or a graf using "connection" events instead of single Built or Teardown events. Thanx in advance. Roman ... View more