I am trying to construct an apparmor profile for my Splunk forwarder agent. I have installed the agent and it is currently sending logs to my Splunk Enterprise server. But when I try to generate apparmor profiles using "aa-genprof" command, I do not see any actions in the output.   How can I generate apparmor profile for my Splunk forwarder agent? I could not find any predefined profiles on the internet either. ... View more

Are there any logs maintained by the Splunk Universal forwarder in case of log processing failures? I would like to setup an alert and dashboard for the log processing failures that occur while the Universal forwarder tries  logs to my indexer. I need this for compliance purposes. I checked out the URL - https://docs.splunk.com/Documentation/Splunk/8.2.4/Troubleshooting/WhatSplunklogsaboutitself, and thought splunkd_stderr.log on my servers would do the trick. But when I checked the corresponding logs, I could see only start and stop messages. Can someone provide me the keyword search and the filename for log processing failures in the Splunk Universal Forwarder? ... View more

I have a splunk forwarder setup in my server to forward all my logs to Splunk. I could not find a default message field in Splunk search. I would like the log string to be part of a specific field - 'message'. So, I decided to configure it in the splunk forwarder settings as follows: #/opt/splunkforwarder/etc/system/local/transforms.conf [message-transform] REGEX = * FORMAT = message::"$1" WRITE_META = true #/opt/splunkforwarder/etc/system/local/props.conf [host::*] TRANSFORMS-message = message-transform #/opt/splunkforwarder/etc/system/local/fields.conf [message] INDEXED=true But even with this configuration, I am not seeing the message field in my Splunk search. Am I missing anything? ... View more

I am trying to set up Splunk Add-on for AWS to pull my logs from my AWS account into splunk. I have a Splunk Enterprise setup on prem in an AWS EC2 server. I used the Splunk Enterprise AMI. I have attached an EC2 instance role that has administrator access. When I try to configure an input, I get the error - Unexpected error "<class 'splunktaucclib.rest_handler.error.RestError'>" from python handler: "REST Error [400]: Bad Request -- An error occurred (InvalidClientTokenId) when calling the GetCallerIdentity operation: The security token included in the request is invalid. Please make sure the AWS Account and Assume Role are correct.". See splunkd.log/python.log for more details.   Note: I did not add any account or IAM role manually in the Splunk UI. The IAM role was autodiscovered by Splunk, and is visible in the Account tab in the Configurations page. ... View more