Hi folks, Does anybody knows how to change the hostname of the clients that appear in the forwarder management of the Deployment server? I tried with: Server.conf [general] serverName = <ASCII string> * The name that identifies this Splunk software instance for features such as distributed search.  Inputs.conf host = <string> * Sets the host key/field to a static value for this stanza. * Primarily used to control the host field, which will be used for events coming in via this input stanza. But changing those settings in the Universal forwarders does not change the client hostname in the Deployment server (forwarder management). Any ideas? Thanks in advance! ... View more

Hi Folks,  I have the following issue on my Cluster Master when trying to create an index via Cluster Master and push the bundle: [Critical] In index 'oxxion': Failed to create directory '/opt/indexes_frozen/oxxion' (File exists) I have been unable to identify what the issue is. Does anyone has an idea on how to resolve this? Thanks in advance! ... View more

Hi folks, I have an issue with a HF, I'm getting some spikes reaching the 100% when sending data to Splunk Cloud. This happens every 30 seconds approx. I think this is because of the amount of data we are sending, this is also causing that all data get with a delay to Splunk Cloud, I mean the _time and indextime is different in all data because of this. So I have some questions: 1- How can I check if I'm sending a big amount of data at similar times during the day? Do you have a query I can use or a dashboard? 2- What are your recommendation to distribute the big data to be sent at different times?  I really appreciate your help on this. Thanks in advance! ... View more

Hi folks, I want to monitor a cloud watch metrics of single ec2 instance. How to just monitor metrics in a single instance? I tried Splunk AWS add on but I couldn't  configure my aws account. The problem is that while using data manager it is giving the results of all the running instance data, but I need to just monitor a single instance. Thanks in advance, ... View more

Hi folks, I'm tying to list all users from my Splunk cloud using this link: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTaccess#authentication.2Fusers:~:text=s%3Adict%3E%0A%20%20%20%3C/content%3E%0A%20%3C/entry%3E-,authentication/users,-https%3A//%3Chost%3E%3A%3CmPort However I'm using a custom role who just have the following capabilities:   * admin_all_objects * rest_access_server_endpoints * rest_apps_management * rest_apps_view * rest_properties_get *edit_user *search The user is unable to pull all users. My assumption is that as this users does not inheritance any other role then it is not able to list all users, as per the grantableRoles. If I'm right, what chance do I have for this user to pull all users with the rest API? or what capabilities I'm missing? Thanks in advance,   ... View more

Hi Folks, I'm very new at syslog server configuration but I have a question about this. I have an IF (universal forwarder) and I want it to act as a syslog server as well. I want it to receive the syslog logs on a different port (not 514). The port 30001 for example.  That port should be open from the Splunk side or from my network side? I appreciate any comment or documents to further understand this. Thanks. ... View more

Hi folks, I have a host that is sending different logs to Splunk, this host sends various logs successfully except for the syslog-ng logs. Here you have an example of the inputs config (there are 3 inputs in this way not being received by Splunk) [monitor:///store/data/log/cisco_ise] disabled = false host = xxxxxxxxxx index = syslog sourcetype = cisco:ise Inputs appear when using the command 'splunk list monitor', then it doesn't seem a permissions issue. Other logs are being successfully ingested by this host. the syslog-ng is working as expected and it is receiving and storing logs on the hdd Does anyone has an idea of steps I can follow to troubleshoot this? Thanks in advance, ... View more