Hi, I have a requirement to implement the Splunk Monitoring Console (DMC) in a High Availability (HA) setup. At present, we are operating with a single DMC server, which creates a single point of failure and poses operational risk in the event of downtime or hardware issues. To mitigate this, I am considering the deployment of two new virtual machines (VMs) configured as identical DMC instances, placed behind a load balancer to ensure redundancy and continuous availability. Could you please share your perspective on whether this solution is technically sound, and highlight any potential risks, limitations, or lessons learned from your past experience that i should take into account before proceeding? Thanks in advance ... View more

Hi, To implement high availability for the Splunk Search Head Deployer across multiple regions, would it be possible to place a load balancer in front of the two deployers and configure the conf_deploy_fetch_url setting in the server.conf file on all Search Head Cluster members to point to the load balancer’s VIP? Would this approach work on  below scenarios? Please advise. When does the deployer distribute configurations to the members? The deployer distributes configurations to the cluster members under these circumstances: 1) When you invoke the splunk apply shcluster-bundle command, the deployer pushes any new or changed configurations to the members. See Deploy a configuration bundle. 2) When a member joins or rejoins the cluster, it checks the deployer for configuration updates. A member also checks for updates whenever it restarts. If any updates are available, it pulls them from the deployer. server.conf [shclustering] conf_deploy_fetch_url = <URL>:<management_port> ... View more

  Hi, We are seeing log parsing issue with Juniper SRX logs for the following logs RT_FLOW_SESSION_CREATE RT_FLOW_SESSION_CLOSE. It doesn't parsing at all. As far as i could see from the release notes that the Add-on has a known issues with Junper SRX Logs Parsing for RT_FLOW_SESSION_CLOSE_LS. However not with the ones which i mentioned above (RT_FLOW_SESSION_CREATE or RT_FLOW_SESSION_CLOSE). Can you please help. Is this related. ? Date filed Issue number Description 2022-12-29 ADDON-59372 Junper SRX Logs Parsing for RT_FLOW_SESSION_CLOSE_LS ... View more

Hi, I am getting this error when trying to click on set-up option for the ServiceNow SecOps add-on. It was working at the beginning when it was installed and was able to provide the integration details. But later, i am seeing this error popped up when trying to view the set-up configuration. Any lead to this error would be helpful to better understand the issue. Error: "Unable to render setup. Most likely, the cause is that the setup.xml file for this app is not configured correctly. For example, it may not specify task and type attributes. Contact the application developer to resolve this issue. setup_stub"   Thanks in advance,       ... View more