The only problem with this way is DHCP log file size on DC. I am also trying with Splunk Stream app, but it is complicated to fulfil the use case, MAC - IP - Hostname  Details from the logs, with stream we get all the data from DORA process and I believe DHCPREQUEST and DHCPACK is where I should get the details.   But not able to figure out the fields, mostly I should received the desired values on this fields but not always this is true. chaddr yiaddr client_fqdn Has anyone successfully configured stream for DHCP logs and have getting the logs required for asset inventory (MAC-IP-Hostname)?   ... View more

Yes, the custom sourcetype must be referenced on the syslog server so Splunk knows to apply that sourcetype to the data. Submit your custom to Splunk Cloud by going to the App Management page in your SC instance.  Then select the Uploaded Apps tab and click the Upload App button.  Provide your splunk.com credentials (those you use for splunkbase) and choose the file to upload.  Splunk will automatically run AppInspect and let you know the results.  If the app passes AppInspect then there will be a link you can click to install the app; otherwise, review the results to see why the app failed. ... View more

@eavent_splunk I might be too late to reply to this post. But where should we run the command ? under bin folder or under splunk home Cause I am getting error,  Could not look up Home Variable Auth Token cannot be cached. I am doing it from Deployment server, executing command under config explorer ... View more

Ok thanks, I haven't tested it on Splunk 8.1, and given the other commenters experience I excpect you to experience the same issue, probably in splunkd.log instead of the TA logging because it doesn't even get that far. If you provide me privately with a client id and client secret to test with I can look into it, but don't expect a quick turnaround as I have other stuff to do as well.  ... View more

Hi @PratikPashte, please share a sample of your logs. Could you display your regex using the Code Sample button? Ciao. Giuseppe ... View more