Hi @gcusello  unfortunately doesn't works, for example if I created a condition to exclude the sourcetype stash like this: [default] EVAL-cliente = if(sourcetype="stash","",index)   when you call for example the index with stash sourcetype, you will have the cliente field empty, but I need no field for that sourcetype. I suppose the best strategy is define  any field -alias for all sourcetypes and don't set any rule for stash ... View more

Hi @gcusello    calculated or field-alias is the same under default stanza on props, I need a strategy to exclude the stash sourcetype.   Regards Ale ... View more

Hi @gcusello  I hope you are well. I need  the field client based on the  index field value  for all my data except for stash sourcetype, currently the field alias works fine with the global configuration but I didn't find to exclude the souretype stash. ... View more

Hi @glc_slash_it    unfortunately this solution doesn't works. need to find another solution ... View more

Hi @davietch    I think the best way to use tls for syslog sources,  the best way is: use syslog ng or rsyslog and use uf tls to send data. Please check the example here https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html   ... View more

Thanks @PickleRick  ... View more

Hi @PickleRick z, @gcusello ,   thanks for your confimation guys, just last question, do you know or exist some official documentation  about that? I mean the load balacing across the hec, no generic documentation. ... View more

Hi Glad to hear you and thanks for your reply, I'm totally agree with you this is just a proposal from my client and I wanted to hear other opinion. Now I consulted him to follow the splunk best pratices. Regards Alessandro @gcusello ... View more

Hi @PickleRick , @gcusello ,   thanks for your reply, I have another question. If I archive the logs in the thawed path on the single indexer and I restore the data on the cluster indexer, could be works? Regards Ale ... View more

Hi @vikashumble    have you define the server.conf both the HF and UF? please check the documentation https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/ConfigureSplunkforwardingtousesignedcertificates Also I think you have to create a folder to put your own certificates in this path: /opt/splunk/etc/auth/   ... View more

Hi @thahir    how many buckets have your indexes? can you check on the path where are stored? Regards ... View more

Hi @SplunkDash    there are many ways to manage this first one: use a deployment server (reccomended) go on the /opt/splunk/etc/deployment-apps/ and create your small app mkdir -p small_app/local and put your conf file on the local folder go on the deployment server web interface and crate a class server to push your new app. connect in ssh on the HF and create a small app (not reccomended) quick tip if you are not familiar with the cli you can use this app to manage conf by UI https://splunkbase.splunk.com/app/4353/ Regards ... View more

Hi @PavanSeerapu  I think the bestway is metadata try this search to check the count of events splitted by sourcetype | metadata type=sourcetypes index=* Regards ... View more

Hi @SplunkDash  yes the best pratices are create a small app to put your configuration. be careful props and trasforms doesn't works on the UF, if you want use that file you have to install HF. Regards Alessandro   ... View more

Hi @thahir    the best pratices suggest to set the ulimit like this:  modify /etc/security/limits.conf ulimit -n 65535 ulimit -u 20480 ulimit -f unlimited ulimit -d unlimited   use ulimit -a to check the configuration Also don't forget to disable the THP Regards Alessandro   ... View more

Hi @deodeshm  Also notable events are stored in notable index. you can see the notable info with this search. search `notable` | eval rule_name=if(isnull(rule_name),source,rule_name) | eval rule_title=if(isnull(rule_title),rule_name,rule_title) | `get_urgency` | `risk_correlation` | eval rule_description=if(isnull(rule_description),source,rule_description) | eval security_domain=if(isnull(security_domain),source,security_domain) | expandtoken ... View more

Hi @ofaheem  you can use outputlookup command in your search, there aren't limits. Or you can follow this article https://www.splunk.com/en_us/blog/tips-and-tricks/help-i-cant-export-more-than-10000-events.html?_ga=2.243025922.1284747645.1648457956-364363015.1644842228&_gl=1*1dvw5a4*_ga*MzY0MzYzMDE1LjE2NDQ4NDIyMjg.*_gid*MTI4NDc0NzY0NS4xNjQ4NDU3OTU2   ... View more