Check C:\Program Files\SplunkUniversalForwarder\etc\splunk-launch.conf and make sure SPLUNK_HOME is set to where you installed. Typically SPLUNK_HOME=C:\Program Files\SplunkUniversalForwarder  ... View more

It looks like the input script isn't running: If it hasn't worked at all, I would start from scratch. In the TA, I would delete the connection and the input and recreate them with a new API key. Regenerate a new API key: Sign in to the Insight Platform. Select the gear icon in the top menu and click API Keys. Select Organization Key. Select + New Key. Enter a name for the key and click Generate. Copy and store the generated key in a secure location. Recreate the connection Navigate to the Rapid7 InsightVM Technology Add-On available under the Apps menu in Splunk. Select Configuration. Select Add. Enter a name for the connection. Enter your region, which is a two-character string based on your location (such as us). Additional region information is available in the Supported Regions section of the Product APIs page. Enter your generated API key. Click Add. Recreate the input: Inputs > Create New Input all per the doc https://docs.rapid7.com/insightvm/insightvm-technology-add-on-for-splunk/ Also, if you are using an older Splunk install, check /opt/splunk/bin/ and see what python you have. I believe the input in the TA uses python3 by default. Also, may try: A different index (i.e. test2) Restarting splunkd If you're still not getting data in, the issue is likely not with Splunk. The TA is vendor built and supported, so I would reach out to Rapid7 and see if they can t/s the connection. ... View more

Hi there, Splunk UF, by default, doesn't create anything or operate outside of $SPLUNK_HOME, in this case C:\Program Files\SplunkUniversalForwarder\ Being this is outside of $SPLUNK_HOME, SplunkUniversalForwarder_script\ is likely a custom folder created by an individual. It looks like the download blat zip file contents were extracted into that folder. Not sure if they integrate at all, but they are certainly separate installs and not associated with each other by default. -- If you found this helpful, give it a thumbs up for good Karma! ... View more

Thank you @gcusello and sorry for the delayed acceptance. FYI for anyone looking for the specific solution, it was a known 8.2.6 issue https://docs.splunk.com/Documentation/Splunk/8.2.6/ReleaseNotes/Knownissues SPL-200532 ... View more

Also, you could try the suggested steps mentioned here  https://community.splunk.com/t5/Getting-Data-In/High-CPU-utilization-with-splunk-9-x-mainly-windows-UF/m-p/634456#M108566 ... View more

Hi there, Question is a little broad without knowing what you've done already. To resolve, will require a bit more info: 1. Is this a standalone instance or a forwarder in a distributed deployment? (if it's a forwarder, are any other inputs whos data is successfully being forwarded to the index layer and indexed? (to eliminate firewall or traffic blocking at the receiving node or along the path)) 2. Does the index "test" exist and is it enabled? (search: | rest /services/data/indexes | search title=test | table title, disabled or Settings > Indexes > filter for test) 3. Have you checked the _internal logs for any errors with the mod input 4. Have you confirmed the input key is correct and able to authenticate to the API (try deleting and recreating the input in the TA) ... View more

Hi there, Most likely 1 of 2 root causes: 1. You do not have indexer configured to received on 9997 https://docs.splunk.com/Documentation/Splunk/9.0.4/Forwarding/Enableareceiver 2. You have a firewall blocking inbound data on 9997 (either firewall on the receiving host, or along the path to it) Let us know what you find! And an upvote would be appreciated! ... View more