My Web Datamodel was set to 3 months with 67 GB+ size on disk. I reduced the summary range to 1 month, and size on disk increased to 100 GB+ size on disk. This doesn't make sense, can someone help explain? I would've thought less time range equated to less size on disk.  ... View more

I'm trying to install a fresh install of Enterprise Security onto a search head cluster.  I uploaded the app via the GUI onto the shc deployer, but before I click start configuration process, I note the following message:  Single Search Head Deployment Splunk Enterprise Security is being configured on a single search head deployment. How do I get it to recognize it is a search head cluster deployer?  ... View more

I recently updated Splunk_TA_Windows and am seeing this error on my search head cluster: [Indexers] Could not load lookup=LOOKUP-user_account_control_property This is an automatic lookup generated in the default directory of the app. I'm not familiar with it and am not seeing this error on my deployer(standalone) instance. The configs appear the same. Any help is greatly appreciated. Thanks   ... View more

Hi, I'm trying to pull in Windows Event logs from the Windows PowerShell path. This path includes 800s, which I've seen in event viewer so I know they're generated and stored here. I just can't seem to pull anything and I don't see much help on the internet to pulling this path. This is my inputs.conf:  [WinEventLog://Windows PowerShell/] disabled=0   Note: This is different from the other PowerShell path where I get my 4103 and 4104 codes:  [WinEventLog://Microsoft-Windows-PowerShell/Operational] disabled=0   Any helps is appreciated. Thanks. ... View more

I need to index a file: /var/log/file.txt. This file runs every day, but sometimes the content doesn't change. This leaves me with no events on days that remain the same. I need it to index every time the timestamp changes on the file. I believe I need to add crcSalt =<SOURCE> to the inputs.conf in order to reindex it. However, my inputs monitors all files in /var/log. So if I add that to that input monitor, it would likely apply to all files in var log reindexing them all every time. Something I don't want. How can I reindex just this file daily while leaving the other files in the directory unchanged?  Many thanks ... View more

I run a search head cluster with Splunk Enterprise. Typically I update apps via the back end CLI, but am wondering if I can update via the GUI. My question is: does the GUI >> Manage Apps >> Find App >> Click "Update App to #.##" update the apps on all of my search heads or only on the one I am viewing? I've always been told to go through the cli so never have attempted this.  Thanks.   ... View more