Hello everyone Few words about setup that i have: -about 30 indexers in cluster. -following data chain: Syslog Forwarder ( or UF installed on servers) -> Intermediate forwarder(s) at particular sites -> Intermediate Forwarders tier ( 4 IFs machine) - > indexer tier. When i am checking indexing rate in DMC I can see that no all indexers have similar indexing rate: 4-5 of them have quite indexing rate, rest 15-20 have medium value and rest of them seems to be not used in indexing process. I want to ask if there is any way how to configure setup in order have balanced value of indexing rate  for all indexers, In other words i want to get situation that for most of indexers indexing rate will be at similar level. Should I use load balancing for achieving  this goal ? BR Dawid ... View more

Hello everyone I have linux server machine  (CentOS 7) where Splunk universal ( version 8.0.3 ) has been installed After installation of agent there was deployed app for connecting on deployment server. Unfortunately machine is not visible in DS, First I have checked if dns name of DS can be resolved there and if host can communicate with DS on 8089 dest port at all with telnet program. There were not find any issues. I decided to look at internal splunk logs by following search: index=_internal earliest=-20d@d latest=now hostname OR x.x.x.x sourcetype=splunkd ( where x.x.x.x is IP of linux server) I could see following warning there: " 02-03-2021 08:04:09.080 +0100 WARN HttpListener - Socket error from x.x.x.x:13258 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version numb " My question can that error be related to problem with connection between linux server and DS ? If yes, how i can resolve that issue. On DS i have installed following version of Splunk: Splunk 7.2.0 (build 8c86330ac18) Thanks in advance for your help BR Dawid ... View more

Hello Everyone on Splunk Forum. I want to integrate logs from following Fortinet devices 1) Switch, model: FortiSwitch148E-POE 2) Access Points, models: FortiAP 221C and FortiAP 221E I am aware that for Fortinet Firewall ( Fortigate ), i can install TA for that. For Forti Switch I have found following manual:https://kb.fortinet.com/kb/documentLink.do?externalID=FD44999 But what should be done on Splunk side for getting Fortinet logs properly proccessed by Splunk, i could not find addons for that. Thanks BR Dawid ... View more

Hello Everyone on Splunk Forum I have problem with sending DC to Splunk Setup. This DC machine first should send logs to IFs tier and after this place events in indexer. I have checked internal logs for this particular machine with "ERROR" log_level. Interesting thing which has found by me is problem with 'TcpOutputFd' There are folling messages Connection to host=10.200.80.11:9997 failed. sock_error = 10054. SSL Error = No error Connection to host=10.200.80.12:9997 failed. sock_error = 10054. SSL Error = No error Connection to host=10.200.80.13:9997 failed I am not very familiar with managing distributed Splunk setup - I am still learning new things. Could you please tell me how i can resolve this problem. Thanks BR Dawid ... View more

Hello Everyone. I had following problem: existing data from kvstore has been overwritten. Is there any way to restore data ? Thanks ... View more

Hello everyone I have following problem: I have set disabled flag in ip_intel by following query: | inputlookup ip_intel where _key="js.arcgis.com" | eval disabled="1" | outputlookup append=true ip_intel After some time I discovered that disabled field value disappeared. My question how I can monitor when and why value isn't anymore in its place. I thought about using internal indexes. ... View more

Hello All I have problem with Splunk ES, today I've noticed that there is no new alert in Incident Review Panel. I have checked notable index, and there is also no new alert. The same situation in case of information in threat_activity index. My humble question is where I can start investigate the issue, in my opinion it's problem with matching data against searches. Thanks BR Dawid ... View more

Hello All on Forum I have following problem with threat intel in Splunk ES. I have got IoC, which is IP address and it has been placed in ip_intel. This triggered alert where ioc IP reached some my external IP on 80 dst port ( It looks like someone accessed my company web-page) Based on description of malware associated with IoC, It's not threat, risky situation should be in other direction, when my machine tried reach url with this IP. My question is: Should I move IP to http_intel collection when I am aware of context ? I would like ask you also about good practices regarding organizing threat_intel collections. Should I create more correlation searches, which will cover particular threat or just use one for threat_intel things? Thanks a lot ans sorry for bad English. BR Dawid ... View more