I am pulling together a small single server Splunk deployment. Because the deployment is on a small scale, I intend to have the couple of syslog endpoints connecting directly to the Splunk server (not via a separate syslog server with UF). I would therefore like to configure  a TCP/TLS syslog input on my Splunk Enterprise server. I have also just discovered that Splunk now supports TLS 1.3. Based on this I would like my deployment to only use TLS1.3 (not TLS1.2 or earlier). From what I have read, I have to configure settings in server.conf as follows: [tls1.3] cipherSuite = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256 groups = prime256v1, secp384r1, secp521r1 What I am trying to figure out though is how to configure the inputs.conf file. I'm thinking that I would need to configure inputs.conf as follows: [tcp-ssl://6514] Connection_host = ip index = network sourcetype = syslog disabled = false [SSL] SslPassword = <password> serverCert = /opt/splunk/etc/auth/splunkweb_combined.cer sslVersions = tls1.3 Does the above look correct?  I'm assuming that:  The "cipherSuite" and "ecdhCurves" sections in the [SSL] stanza of inputs.conf would only apply to TLS1.2 and therefore wouldn't be required if using TLS 1.3.   That I need the [tcp-ssl://port] stanza to be able to specify index/sourcetype etc settings for this traffic. Thanks in advance for any thoughts. ... View more

I am in the process of pulling together a design for a new Splunk deployment. The deployment will be on the small side and use a single server deployment running on RHEL. Looking through the Splunk documentation, I can see two key decisions I need to make regarding archiving old Splunk data: When rolling data from Cold to Frozen I can use either "coldToFrozenDir" or "coldToFrozenScript" to do the actual copying of data. Whether cold data is rolled to frozen on either a locally attached drive or to a file share server. On point 1. above: Are there advantages to using the custom script over the standard coldtofrozendir? (I'm just looking for a straight-forward data copy option. ). I believe I've read somewhere that if coldtoFrozenScript fails to copy data then it retries again after several minutes. Is this also the case for the coldtoFrozenDir option ... if it fails to successfully copy it will continue to retry? On Point 2. above: For the location of my frozen data, I also have the option of a large separate locally attached drive on the Splunk server (separate to my hot/warm/cold drives) or I could copy it to a remote SMB/NFS file server on the local LAN. In either case I would still be archiving the frozen data to tape over time as well. Are there benefits in copying the data to a locally attached drive over a file server? or is it better just to keep frozen data off the Splunk server entirely? Thanks in advance. ... View more

I have a Splunk Standalone instance running at v8.2.10 I have recently installed the Microsoft Add-on for Microsoft IIS (version 1.2.0) on my Splunk server and have also deployed this app to a windows server with IIS installed (and a UF installed). However I seem to be having difficulties getting any logs from this IIS server.  If I do a search on data in this new index (index=windows_iis), it is returning no results. If I look under Settings>indexes, I can see the newly created index, however it has 0 for event count.   These were the basic steps I have followed so far: I have created a new index for these logs called "windows_iis" - all other settings as default. Installed the Microsoft Add-on for Microsoft IIS on my Splunk Enterprise instance (combined Search Head/Indexer/deployment server). I have copied the contents of this add-on to the /opt/splunk/etc/deployment-apps folder Within the deployment app I have created the following inputs.conf file under the deployment app local directory: [monitor://C:\inetpub\logs\LogFiles] disabled=false sourcetype=ms:iis:auto index=windows_iis I have reloaded the deployment server. I have created a new server class and pushed this app out to the IIS server.  I have gone through and done the following troubleshooting steps: looking on the IIS server in c:\program files\splunkuniversalforwarder\var\log\splunk\splunkd.log, I can see: UF on IIS server is showing connected to my indexer. The UF has "adding watch on path: C:\inetpub\logs\LogFiles". So the UF is monitoring the IIS log files. I am also getting some INFO messages - "ChunkedLBProcessor Failed to find EVENT_BREAKER regex in props.conf for sourcetype: ms:iis:auto. Reverting to the default EVENT_BREAKER regex for now". Not sure how relevant these are? I think my problem might be more fundamental? If I do a search on my Splunk Enterprise instance as follows: "index=_internal host="IIS_Server01" component=Metrics group=per_sourcetype_thruput series="ms:iis:auto" ", I can events being sent from the UF on the IIS server (e.g kbps=0.557, eps=3.3, kb=33, ev=202). I can actually see logs in C:\inetpub\logs\LogFiles\W3SVC1 folder on the IIS server, so there is data there to collect.  Does the modified local/inputs.conf need to also be configured on the Splunk Enterprise server app or is this inputs.conf configuration only needed on the UF deployment app (which is what I have done)? Any thoughts on why these events aren't being ingested by my Splunk Enterprise server would be greatly appreciated. Thanks, ... View more

I have a standalone instance of Splunk. I am running both: Splunk Add-on for Unix and Linux, and Splunk App for Unix. Since the Splunk App for Unix has reached End-of-Life and is not required in my deployment anymore i am looking to remove it. Initially i tried just using Splunk command: ./splunk remove app splunk_app_for_nix However noticed that this impacts the index "os" used by the Splunk Add-on for Unix and Linux. The index no longer appears in the web gui under settings>indexes. If i look in the CLI, i can still see data in /opt/splunk/os/db, so the data still appears to be there, but is not being used apparently.... I am getting Message saying "Received event for unconfigured/disabled/deleted index=os ...", so am not entirely sure what the status of this index is now. What is the best way to remove this app without affecting the index? Thanks,     ... View more

I am currently running an on-Prem Splunk installation and am trying to figure out the best approach for ingesting data from our VMware environment. Currently i've got just a very basic setup with syslogs from my ESXi hosts and vCenter going to a Syslog server and monitored by a universal forwarder on the syslog server for forwarding to my indexers. That all works reasonably well, however would like to be able to use some pre-developed dashboards. I have noted that there are a number of VMware add-ons that can be used. Also we are looking to move towards ITSI in the near future so would like to amend the way i ingest WMware data so that it is compatible with this. At a fundamental level, I think i'm struggling with understanding the difference between "Splunk add-on for VMware" and "Splunk add-on for VMware metrics". Is there a reason why i would pick one of these over the other (or do you normally install both)? ... View more

Hi, I am running a single instance Splunk deployment on Linux and am planning on upgrading a bunch of Apps on my Splunk Enterprise server (there are about 7 that need upgrading ... a mix of Apps and Add-ons) . I was intending to upgrade the Apps using the GUI. My question is whether it is better to restart when prompted by Splunk (potentially after each app is upgraded) or whether it is possible to do all of the upgrades and then do a single restart of the Splunkd service at the end?   Thanks, ... View more