We have an asset database that keeps track of decommissioned assets. We can make a table of all decommissioned assets in our environment. Is there a way to use the REST API to remove those assets from the deployment server. Something like: "Status="end of life"| foreach AssetName rest DELETE https://localhost:8089/services/deployment/server/clients/AssetName" ... View more

We have 3k+ servers comprised of Linux, Windows, Solaris, and AIX. We would like to place different customers in separate indexes. We have this setup in Windows by having a customer app that points to the customer index and having multiple copies of the Windows app on our deployment server. This does not work for the Linux TA app since it appears there are files where the path is hardcoded to Splunk_TA_nix. Any ideas how to send data to the correct customer index based on the hostname and OS rather than have all Linux OS data in the same index? ... View more

We setup a centralized syslog-ng server. We are receiving logs from multiple different sources without issue. The logs from CyberArk Vault server are the only logs delayed an hour or more with no line breaks for new lines. The Splunk CyberArk TA is installed on the syslog server and the search head. It does not appear logs are being parsed when sent to Splunk as expected. Any help would be appreciated. ... View more

We're sending CyberArk Vault data to Splunk via a syslog-ng server. We have a number of sources going to the syslog server. CyberArk logs are delayed from writing to the directory by over an hour. The other issue is Splunk_TA_CyberArk doesn't appear to be splitting up the vault log files like it should. CyberArk is running 9.10. Splunk is running 7.0. Any help would be appreciated. ... View more