Splunk Universal Forwarder - Route wineventlog to one output group and _internal to another I'm trying to configure a Universal Forwarder so that: wineventlog data is sent only to [tcpout:group1] _internal data is sent only to [tcpout:group2] Currently, wineventlog is routing correctly to group1, but _internal events are being sent to both group1 and group2. My goal is to stop _internal events from being forwarded to group1 and have them forwarded exclusively to group2. I've already tried overriding _TCP_ROUTING=* by setting _TCP_ROUTING = group2 on both the monitor://...splunkd.log stanza and the [splunkd] stanza, but _internal data is still being forwarded to both output groups. I've also reviewed Splunk's routing and filtering documentation, but I'm not sure what additional configuration is needed. What is the correct way to exclude _internal events from group1 while continuing to send them to group2? Is there a props/transforms-based routing configuration or another setting I'm overlooking? ... View more

Can someone help me with these regex on inputs.conf on universal forwarder? For some reason, isn't working. Much appreciated! blacklist7 = EventCode=4673 Process_Name="C:\Program Files\WindowsApps\AD2F1837.myHP_25.52341.876.0_x64__v10z8vjag6ke6\win32\DesktopExtension.exe" blacklist8 = EventCode=4673 Process_Name="C:\Program Files\WindowsApps\AD2F1837.myHP_26.52343.948.0_x64__v10z8vjag6ke6\win32\DesktopExtension.exe" ... View more

Hi all, I have data coming in, parsing and indexing correctly to a windows index. This data comes in with either one of two sourcetypes: "WinEventLog" and "wineventlog".  The sources appear to be the same, so I am having difficulty understanding what corresponds to each sourcetype. Any help is appreciated. Thank you.   ... View more

What is best practice when utilizing a search from the below apps? What pros/cons should I consider from each? I appreciate any guidance here.  1) Enable the search stored in the app? 2) Clone the search and store in a custom company-specific app, and enable there?  DA-ESS-MitreContent DA-ESS-ContentUpdate ... View more

An app was updated via the GUI on a SHC member. What exactly does the Splunkbase install do/check? What needs to be done to un-do any changes made? Is it just best to uninstall the app and redeploy from SHC deployer? Default/app.conf shows the old version number, which makes me think that the files weren't actually updated everywhere. Wondering the best route to proceed to fix the mistake.  ... View more

I'm trying to run the below command on my search head cluster deployer:  splunk start-shcluster-migration kvstore -storageEngine wiredTiger -isDryRun true I receive the following message:  Admin handler 'shclustercaptainkvstoremigrate' not found. This is after I have edited $SPLUNK_HOME/etc/system/local/ on each search head in the cluster, following: Migrate the KV store storage engine - Splunk Documentation   [kvstore] storageEngineMigration=true Please advise. ... View more

I'm trying to change the color of a row in a table based on the value of a field 'action'. If it's equal to "allowed", I want the row to be green. If it's equal to "blocked", I want it to be red.  How can this be done in the code? I'm not seeing much documentation online for manipulating context.  Thanks in advance and appreciate the help. ... View more

I'm trying to change the font size of a table in a dashboard studio visualization. How is this done in the code? I've tried a few ways but having no luck. Thanks in advance and I appreciate the help. ... View more

I have correlation searches in ES that are not generating notable events as they should be. When I click on content management and find a search that isn't working, it shows a green check mark next to the index but a red exclamation mark next to the sourcetype, saying that there have been no events in that sourcetype for the last 24 hours.  I want to know if this is the cause of my issue, and what I can do to troubleshoot it. I see there are events in the sourcetype/index specified, and they are visible in the search box of the ES app.  ... View more

Hi, I'm looking to match my list of qualys events against the list of CVEs found in the KEV lookup on cisa.gov. I'm not having any success with the below search.  Can you provide any guidance?  For example,  index=qualys  *[|inputlookup cisa_cve.csv | fields cveID]* I need to find my events where my base search that shows CVE contains matches to the KEV lookup returned field.  Any help is greatly appreciated. Thanks   ... View more

Hi,  I'm having an issue with my deployer and search head cluster while upgrading enterprise security.  In step 8 of the Splunk doc below, it states that ES will recognize it is being installed on a cluster during app setup. Mine displays that it is setting up on a standalone instance, the deployer. What do I need to change for the GUI to recognize I am uploading for the cluster?  See screenshot for additional detail.  Upgrading Enterprise Security in a search head cluster environment, step 8: https://docs.splunk.com/Documentation/ES/7.0.0/Install/UpgradeEnterpriseSecuritySHC Thanks ... View more

Question regarding the indexes.conf on my search heads. Each index contains the paths to the home/cold/thawed directories, but they also have a frozenTimePeriodInSecs value and MaxDataSize. My question is are these two values, FTPIS and MDS, able to removed from the search heads? I thought that the indexers house the values for indexes.conf size requirements and search heads only hold the paths to retrieve the data. Please help me understand. Thanks ... View more