1. Whenever possible (I know that sometimes you don't have technical means) try to copy-paste actual text input in the code box (the </> symbol in the editor when you're typing in your post) or in the preformatted style instead of doing a screenshot - it's much easier to work with. 2. As @isoutamo already pointed out - those messages don't seem to have anything to do with time issues (nobody says you don't have time issues, it's just that this particular case is about network connectivity, not time). We don't know your network setup but it seems our hosts don't see each other (or the traffic is filtered somewhere).   ... View more

i failed too... end up with setting up syslog-ng with TLS.  ... View more

You don't do that. As a rule, you install a clean SH and join it to the cluster. You don't fiddle around installing local apps. All config is supposed to be managed within the SHC. ... View more

figured out I was searching for what I got in the example that I got however I got  another question  what about these unknowns and also the src is funky but I think its because if it not known it returns that ::fff10.x.x.x. field but im not sure ... View more

Hi @domino30, Splunk manages configurations conflicts between conf files from different apps, but it doesn't accept duplicated configurations in the same app or conf file. In your case, in the Splunk_SA_CIM_search app, you have two stanzas with the same name, you have to manually remove one of them. Ciao. Giuseppe ... View more

There are several parts as follows: 1: Get new data in. 2: Do the CIM mapping. 2a: Usually there is an app in splunkbase that does this but is it doing it's job well enough?  Check with this: https://docs.splunk.com/Documentation/CIM/latest/User/UsetheCIMtovalidateyourdata 2a1: Sometimes the app does a good job. 2a2: Sometimes the app needs to be fixed. 2a2a: Sometimes the author can be found and cares and will update the app if you send him your fix. 2a2b: Most of the time, your fix is for you alone. 2b: Sometimes there is no app and you have to do ALL of the work yourself. 3: Set your "cim_*_index" macros.  You can use a scheduled search in the "CIM Toolkit" app to do this.  This search can also be scheduled to let you know when your macro needs to be updated:  https://classic.splunkbase.splunk.com/app/6243 The CIM Toolkit is a treasure trove of useful macros, searches, and ideas on how best to leverage the CIM in a SIEM. ... View more

Good day -  The Splunk Engineer recommended ePO as the HF  ... View more

Oh, my bad. Seemed like a typo more than a legitimate name. ... View more

No, deployer does not push .tgz or .spl apps. It pushes unpacked apps. You need to have subdirectories in shcluster directory. I'd advise you read https://docs.splunk.com/Documentation/Splunk/9.0.4/DistSearch/PropagateSHCconfigurationchanges thoroughly since there are several tricky things about app deployment (e.g. push modes) ... View more

Hi @domino30  It's due to at least one app you are looking to deploy from the SHC deployer already being part of the Splunk enterprise base package set.  In our experience, it was due to the Splunk upgrade readiness app (python_upgrade_readiness_app) which is now part of the default base Splunk install. You can check the default base package apps on your search head by looking at its manifest file, e.g.  [splunk@myhost ~]$ awk -F'/' '/etc\/apps\/\w+ \-/{print $0}' $SPLUNK_HOME/splunk-*-manifest d 755 splunk splunk splunk/etc/apps/SplunkForwarder - d 755 splunk splunk splunk/etc/apps/SplunkLightForwarder - d 755 splunk splunk splunk/etc/apps/alert_logevent - d 755 splunk splunk splunk/etc/apps/alert_webhook - d 755 splunk splunk splunk/etc/apps/appsbrowser - d 755 splunk splunk splunk/etc/apps/introspection_generator_addon - d 755 splunk splunk splunk/etc/apps/journald_input - d 755 splunk splunk splunk/etc/apps/launcher - d 755 splunk splunk splunk/etc/apps/learned - d 755 splunk splunk splunk/etc/apps/legacy - d 755 splunk splunk splunk/etc/apps/python_upgrade_readiness_app - d 755 splunk splunk splunk/etc/apps/sample_app - d 755 splunk splunk splunk/etc/apps/search - d 755 splunk splunk splunk/etc/apps/splunk_archiver - d 755 splunk splunk splunk/etc/apps/splunk_essentials_8_2 - d 755 splunk splunk splunk/etc/apps/splunk_gdi - d 755 splunk splunk splunk/etc/apps/splunk_httpinput - d 755 splunk splunk splunk/etc/apps/splunk_instrumentation - d 755 splunk splunk splunk/etc/apps/splunk_internal_metrics - d 755 splunk splunk splunk/etc/apps/splunk_metrics_workspace - d 755 splunk splunk splunk/etc/apps/splunk_monitoring_console - d 755 splunk splunk splunk/etc/apps/splunk_rapid_diag - d 755 splunk splunk splunk/etc/apps/splunk_secure_gateway - Compare it to the apps you are looking to deploy from the SHC deployer. Options: 1. If you want to upgrade a Splunk default app then that is OK, but you'll need to use the recommended  -push-default-apps true parameter.  A symptom of doing this is that after a Splunk SHC member restarts a warning message about the manifest no longer matching is written, which makes sense when you think about it.  We just ignore it. 2. The other option is not to upgrade the default install app and remove it from the SHC deployer. Hope that helps     ... View more

You are right I have got to more specific.  our environment right now is for learning and will lead to a bigger deployment later. currently we have an EXSI server and we had a DC, but I decided to build another dc as to not mess with the current one. after about  a month we wanted to migrate all the machines about 12 from the domain I made to the one that was previously on the Domain controller.' Thus moving domains.  basically, how we moved our windows machine was to disjoin the domain I made and then joined the original domain. The easy fix is deleting the machines from the exsi and rebuilding splunk. I have had thought of deleting instance.cfg and running the clear-config command and restarting but I think I did that for all machines involved if that doesn't fix it. Is there something else I should try? ... View more

Verify you have the right name configured in web.conf.  Check that DNS is working correctly and that the firewalls allow connections to that address. ... View more

Hi if you are using a “golden image” then you should follow these steps, not just copy paste. https://docs.splunk.com/Documentation/Splunk/9.0.3/Admin/IntegratefullSplunkontoasystemimage Otherwise you will get situation which @shivanshu1593 already describe. r. Ismo ... View more

Hi have you followed instructions to create indexer cluster from docs? At least you must add pass4symmkey for clustering when you are adding node to cluster. Without it, it cannot connect to cm and join to the cluster. Use the same key than you have defined o cm for clustering. It should be different than general pass4symmkey! r. Ismo ... View more

The ability to copy-paste to or from a browser's address bar has nothing to do with the security of the connection. 127.0.0.1 is the "loopback" address.  It's the standard address used to talk to the local machine.  Port 8089 is Splunk's management port. ... View more