About vikasg

vikasg · ‎01-07-2026

Thank you @PickleRick for quick response , yes this is only output and input I have so far as I am doing testing . Why I can say my inputs is correct because when I remove outputs.conf completely and try to index data locally on the HF I see the logs . I also tried below just now and now everything is stops in splunk ( I do not see any log in _internal index and nothing in index=main where I should get my windows security logs ) my new confs inputs - remain same outputs [tcpout] defaultGroup = block_all [tcpout:block_all] disabled = 1 [tcpout:raw_syslog] server = <syslogip>:1515 sendCookedData = false persistentQueueSize = 1024MB props [source::XmlWinEventLog:Security] TRANSFORMS-route_to_syslog = syslog_transform SHOULD_LINEMERGE = false TRUNCATE = 0 transforms [syslog_transform] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = raw_syslog

vikasg · ‎01-07-2026

Hello Team , I want to send splunk HF windows security logs to a syslog server . I have syslog-ng installed there which recieve data and write to a file . Below are my existing configurations , I tried syslog and tcpout but in bith cases I see only internal logs are getting written to syslog server . For testing I am picking win security logs locally using HF Inputs on HF [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" renderXml=true index = main props [XmlWinEventLog] TRANSFORMS-route_to_syslog = syslog_transform SHOULD_LINEMERGE = false TRUNCATE = 0 transforms [syslog_transform] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = raw_syslog outputs [tcpout:raw_syslog] server = <syslog IP>:1515 sendCookedData = false type = tcp As I mentioned I tried syslog as well in outputs and _SYSLOG_ROUTING in transforms With both of these conf I am getting only HF internal logs like all sort of audit logs , metrics and splunkdlog on syslog-ng reciever . Can someone please help me where I am going wrong

vikasg · ‎07-28-2025

@livehybrid Thank you for the quick response . Let me a give a shot on this will keep posted here how it goes .

vikasg · ‎07-28-2025

Hello Experts , I have never done this and wonder if there is a best way to achieve below I want to use DS to push intial configurations from DS to CM and then use CM as porxy for IDX cluster . I tried below 1) added CM as client and for the serverclass I have added 'stateOnClient = noop' to each of the app entries just to make sure those application does not work locally no the CM 2) after above step confs lands on cm under /opt/splunk/etc/apps ,however I want them to land to /opt/splukn/etc/master-apps question is can DS put the directories in a diffferent locations than default that is /opt/splunk/etc/apps

vikasg · ‎10-01-2022

I Agree on the points where you mentioned that is it is not relevant, but some how it is working for me .Let me explain why I think . I am installing apps like Event gen , Security essentials, CIM and my custome apps that have DM with Acceleration. What I believe is rather turning on everything at same time I should have wait on each step . I saw some search lag issues as I monitor my instance , after install and with old approach my RAM got sudden hike system hung and spluknd crashed . I just changed my approach and things started working ,Now I have turned on all inputs and I am not observing any crash from last 1 hour , DM are accelerating, Event gen is generating good amount of logs . Earlier it was failing after every 10 min on Ulimit it is permanently set in /etc/security/limits.conf

vikasg · ‎10-01-2022

Since it is POC and I am using trial license for 60 days , I do not think I can open support case on this trial license . I am digging this further , found few things which cause the issue Finding 1) I have moved to older Splunk version like to 8.2.6.1 2) Under ulimit I set maximum memory to like 80% of the over all 3) after installation I gave like 1 hour to the machine to settle , then start ingesting data with low rate 4) NOw I am increasing data flow rate 5) Since it was POC so I ran splunk service with root user only , but now created splunk user and set ulimit accordingly 6) Tweaked some data model acceleration which was were aggressive earlier (actually same machine is acting as indexer and SH ) so better to start slow and gradually increase I hope this will help someone , I am still not accepting my own answer as I am sure I will have few more findings which I will add to this comment

vikasg · ‎10-01-2022

Thank you for the response . This is latest splunk that 9.0.1 and Single Linux box for POC . It has 32 GB RAM with 16 CPU , this is SH come indexer Ulimit is set as per recommendation . THP is disabled

vikasg · ‎09-30-2022

ERROR HttpListener [97417 TcpChannelThread] - Exception while processing request from x.x.x.x:63596 for /en-US/splunkd/__raw/services/search/shelper?output_mode=json&snippet=true&snippetEmbedJS=false&namespace=search&search=search%20i&useTypeahead=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1664562934323: std::bad_alloc Any help please

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎09-30-2021

Online Status	Offline
Date Last Visited	‎01-07-2026 01:58 PM

Why Splunk HF sends all its inthernal logs to Sysl...

how to push apps from DS to CM ?

Splunkd crash after some time with below errors- H...

Re: Why Splunk HF sends all its inthernal logs to ...

Why Splunk HF sends all its inthernal logs to Sysl...

Re: how to push apps from DS to CM ?

how to push apps from DS to CM ?

Re: Splunkd crash after some time with below error...

Re: Splunkd crash after some time with below error...

Re: Splunkd crash after some time with below error...

Splunkd crash after some time with below errors- H...

Join the Conversation