Here is one with the OS versions too (WIn only) index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) by hostname |rename hostname as host |join host [ search index=windows_desktop sourcetype=WinHostMon vendor_product="*" ] |rename host as Hostname, vendor_product as OS, Version as "OS Version", first(version) as "Splunk Version" |table Hostname, OS, "OS Version", "Splunk Version" |sort "OS Version" maybe it is better to use something else than vendor_product, so it is just a quick and dirty solution 🙂 ... View more

Another option is to use syslog-ng's extensive re-write capabilities to modify Prime's not-very-standard syslog. Here is my solution for the re-write statement in syslog-ng. It has modified the logs by putting text within the first [] in the program field and also removes extra timestamp causing troubles when processed as syslog message. After this Splunk can process some parts and I'm sure additional fields can be extracted if someone knows what is interesting and what is not. rewrite r_cisco_prime { subst('\d*:\d*:\d*\.\d*.\w*', "", value("MESSAGE"), type(pcre) flags(ignore-case)); subst('\[', "", value("MESSAGE"), type(pcre)); subst("\w*", "", value("MESSAGE") type(pcre)); set("${0}",value("PROGRAM")); subst('\]', "", value("PROGRAM") type(pcre)); }; ... View more

Link broken by the acquisition 😞 ... View more

It is also worth to mention if you are using Syslog-ng PE or Rsyslog as relay, you can use the builtin disk plus memory buffer function to increase reliability without saving raw logs in files. ... View more

So, the solution: use the UNC path but also make sure the access rights on the share and files set properly, so splunk user can descend into the directories and read the files ... View more

it seems the UNC way is working. At least when I share the files from a windows server. Unfortunately, in my usecase we are sharing from an appliance using Samba and with this there are some access denied errors, but this is not a splunk related issue. So, the solution: use the UNC path but also make sure the access rights on the share and files set properly, so splunk user can descend into the directories and read the files Thank you again ... View more

it seems the UNC way is working. At least when I share the files from a windows server. Unfortunately, in my usecase we are sharing from an appliance using Samba and with this there are some access denied errors, but this is not a splunk related issue. So, the solution: use the UNC path but also make sure the access rights on the share and files set properly, so splunk user can descend into the directories and read the files Thank you again ... View more

I suppose this is where the dog lied buried. When I copied one of the log from the share to the local disk, it is successfully sent to Splunk, however from the share isn't. I've changed the user runs splunk forwarder to my domain account and I also made sure the share is accessible using my domain account, but it is still not working. I suppose when I map a drive, it is not visible to forwarder (or any service account), however I can see in the log this TailingProcessor - Parsing configuration stanza: monitor://Z:. Any idea? Thank you ... View more