I am seeing a very similar issue. Our old environment using the old eStreamer app is working fine. When installing the Encore app in a completely new environment (don't have to worry about old TA messing w/ things) we are seeing a trickle of IPS events (1/20th of what FMC is seeing). After reading the comments above, I disabled the connection events, but after a few hours, I haven't seen any progress. I am not seeing my python process or system resources (core, mem, etc) overtaxed. Is there a manual configuration setting (outside of the .confs) that needs to be made? ... View more

DC/OS has a really good write up on how to configure logging from their platform into Splunk. The write up includes all of the services that can be pulled out of journald and brought into splunk. It also includes commands to create the input stanza. Link: https://dcos.io/docs/1.10/monitoring/logging/aggregating/splunk/ ... View more

I believe that the issue is stemming from the Windows Infrastructure App upgrade when the DNS TA is not also upgraded. It looks like the Windows Infra App is looking to create msad-dns-events eventtype using a search that involves OR (eventtype=wineventlog-dns (Type=Warning OR Type=Error)) Installing Splunk Add-on for Microsoft Windows DNS (https://splunkbase.splunk.com/app/3208/) contains the missing lookup and removes the error. This may need to be installed on a Forwarder, Indexer, and/or Search Head depending on your deployment. Btool export from Windows Infra App's default/eventtypes.conf: [msad-dns-events] search = ((eventtype=wineventlog_application OR eventtype=wineventlog_system OR eventtype=wineventlog_security) (Type=Warning OR Type=Error) DNS) OR (eventtype=wineventlog-dns (Type=Warning OR Type=Error)) ... View more

Robert Miller did most of the work for you so modifying the current app to include CIM can be done in a few hours. Also, please look at splitting the TA out from the App and renaming it to fit the normal conventions that Splunk ES is looking for. It looks gross to have to add your app into the regex field. These settings as robert.miller mentioned above are located in the SplunkES Suite local/inputs.conf file: [app_imports_update://update_es] app_regex = (search)|([ST]A-.)|(Splunk_[ST]A_.)|(DA-ESS-.)|(Splunk_DA-ESS_.) ... View more

I've had multiple inflight-db's when I accidentally ran out of storage. The raw-data directory did not copy over so I removed the inflight's from the target, cleared up some space, and performed the transition again. From Splunk's Blog talking about restoring an Index: Step 3 – What is an in-flight bucket? When Splunk transitions a bucket from warm to cold, it is considered to be “in-flight”. There is the potential scenario where a bucket has not completely transitioned, specifically if the storage crashed during the move process. You can find these buckets by looking for “in-flight” within the text of the directory name. You should remove the in-flight bucket as well as include this bucket ID as one that must be also copied to the primary storage from the back up location. Blog post: http://blogs.splunk.com/2012/02/21/restoring-an-index/ ... View more