In the README that comes with the Splunk_TA_ipfix, there is this line: "This add-on captures binary data sent over UDP, decodes it and provides the index-time and search-time extractions for all IPFIX data sources and templates." "This add-on can parse Cisco Netflow v9+, Citrix Appflow v1+ and other IPFIX streams sent over UDP." "It can be configured to run from splunkd and stream data directly to Splunk, or to run as a linux daemon streaming data to disk (which can be monitored by Splunk)." That last part is what I want to do... capture as a linux daemon and ingest by using a Splunk monitor stanza in an inputs.conf on a UF.... No where else in the massive (8 pages) TA documentation does it provide any further information. , ... View more

In a distributed (but non-clustered) environment, typically the Deployment Server (DS) is made to be the License Master (LM) because that box carries the lowest cpu usage doing it's normal DS duties. I now have a clustered environment and am unsure whether to continue this practice (meaning distributing the app created with the license with a server.conf file) or change to using the Master Node as the LM (due to the _cluster folder for individual .conf file distribution or the Mmaster-apps folder for app distribution to the cluster). I have found no guidance in either the main Admin manual or the Indexing and Clustering manual on this... Any help or guidance from someone who has done this would be appreciated... ... View more

Does anyone have or know where I can find the field format for the Cisco IOS 12.2 log format ? I think I have to build an app to correctly parse the fields and haven't found any apps on Splunk_Base to do this yet... Any help or guidance would be appreciated... ... View more

My client has one consistent password for the admin user throughout his Splunk infrastructure. In attempting to show him how to access a UF via the REST API, I attached to the UF using https://xxx.xxx.xxx.xxx:8089 successfully. It displays the web page with the RPC, services, servicesNS and static selections visible. When he selects anyone of them , (services for example), an authentication box pops up and he inputs his "admin" user id along with the system-wide admin password. The box just refreshes and we get no further... No error message, just the authentication box again.... Any clues as to what the issue might be ??? Thanks all.... ... View more