Hello. I have seen several threads on backing up Splunk but see a lot of different answers so I am not 100% sure which method to follow. I have a relatively simple setup consisting of one Heavy Forwarder, indexer, search head, and deployment server. No clustering. Running Splunk Enterprise 6.5.1. If any of these four main forwarders were to crash completely, what files would I need backed up to restore things back to normal? I am not necessarily interested in restoring logs, mainly concerned with the configuration related files so I don't have to rebuild everything from scratch. ... View more

We use LDAP authentication to log into Splunk. The AD service account we use for Splunk LDAP authentication gets randomly locked out. In our environment we have one heavy forwarder, one indexer, one search head, one deployment server, and around 7 Universal Forwarders. Any clues as to why this account gets locked out? Sometimes it happens a couple of times a day, sometimes it goes over a week before it locks out. ... View more

We have two Active Directory forests in our enterprise with Universal Forwarders installed on all of our domain controllers. The sourcetype and index names in one forest do not match up with the sourcetype and index names of the other forest. Why is that and how can I get the names to be the same? I don't want to have to build different reports for the same thing because the sourcetype and index names are different. SourceType name in Forest A: "wineventlog" SourceType name in Forest B: "main" Index name in Forest A --> "XmlWinEventLog: Security" Index name in Forest B --> "WinEventLog:Security" ... View more

Hello. My Palo Alto firewall logs were successfully forwarding to Splunk for a while, except today I noticed that for the past week it has not been working. Everything from the Palo Alto end configuration looks good. Not sure where to look in the Splunk end first, any ideas or documentation where to look? ... View more

I'm troubleshooting why my Splunk Universal Forwarder (UF) logs in Active Directory Forest B are not reaching my Splunk indexer which is located in AD Forest A. TCP 9997 has been opened up in the firewall between the two forests already. Are there logs in the UF install folder located on the Splunk UF that would shed some light? Or should I be looking somewhere else? ... View more

Hello. Please see the screenshot on this post, its from the Splunk Universal Forwarder (UF) installer steps. Are we supposed to check the box for “Add user as local administrator” when installing a UF on a Domain Controller or leave it unchecked? ... View more