Hi edgarsilva01, Di you manage to find a solution for this. I am having the same problem. My environment was already setup by someone else, and when I do a search with index=sql I get 10 source which include the ERRORLOG files in MSSQL\Log\ folder and another source called "Index SQL CDS Server Audit", not sure where this source is coming from. I cannot see any logs originating from the .sqlaudit file   Kind Regards.. ... View more

Hello, Ahmadkhattak20, We have not solved it, we open a case in splunk and they do not support that app either. The answer was the following "Hope you are doing really well! My name is Russel Andrey. After reviewing the information, I see that the support for this add-on is "Not Supported". Here you have more insights about App support types: https://docs.splunk.com/Documentation/Splunkbase/splunkbase/Splunkbase/Appsupporttypes As best effort from my side, here you have some information that can be helpful for you: - This is the official documentation from the app: https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSplunkOperationsGuide_409.html In case the documentation or steps shared above are not working, I strongly suggest you creating your own question in our communities channel for further assistance. At this point, I will proceed archiving this support ticket." Thanks for your comprehension.     ... View more

Hi Edgar. The Splunk have some features to balance or distribute data indexing over multiples indexers and Datacenters, but Splunk dont have a way to make what you need natively. I think that you can provide this feature using software development, based on type of data ingestion that you need. If you need to create a copy of data in indexer B without a Indexer Cluster, you must to configure it on outputs.conf file in your Heavy Forwarder, [tcpout] defaultGroup = indexerA, indexerB [tcpout:indexerA] server = indexerAIP:9997 [tcpout:indexerB] server = indexerBIP:9997 With this configuration, all data sent to IndexerA, will be sent to IndexerB too.   ... View more

  Hi Thanks for your answer but I need to get a list of all the existing sources and the datamdel to which it belongs Not in my Splunk ambient Something like that   ... View more

You don't say what vulnerability was reported, but perhaps this answer will solve your problem: https://community.splunk.com/t5/Security/Splunk-Enterprise-8089-Vulnerability-Scan-Results-Resolve-these/td-p/493478 It's not enough to put a certificate on the DS - it must be installed on the UF to protect the UF's management port. ... View more

Thanks for the fast response, I will check if his is a solution for us. Manuel   ... View more

Hello @edgarsilva01 I believe the question is more on user's operating system rights/permission to modify the UF. As the admin or root user has all the rights to uninstall/delete a UF in most cases, you may need to set a governance should the said user be assigned as admin/root or not. Linux: Best practice on UF installation is to not install it as root. Try to set a splunk:splunk (user:group) for this and set permissions for this splunk-specific user:group. https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/RunSplunkasadifferentornon-rootuser Windows: Though I'm not very particular on Windows installations but UF is installed as Admin in most cases. Then from here, user rights can be managed on AD. Should the UF was installed on a non-admin user, the forwarder installs and runs in "low-privilege" mode. https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller Hope it helps! ... View more

Configure your forwarder to use "batch" instead of "monitor", and set "move_policy =sinkhole". This will cause the forwarder to delete the file after it's been ingested. Once your process creates a new file, the forwarder will pick it up and you'll get only the new results. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#BATCH_.28.22Upload_a_file.22_in_Splunk_Web.29: Ignore the "Upload a File" portion in the documentation. Not sure why that is there, it's misleading. ... View more

Update: I changed the video link to youtube version. ... View more