Getting the same error.  Unable to create FIFO: path="/opt/splunk/var/run/splunk/dispatch/ Please assist ... View more

Hello, to send syslog from vcenter to Splunk (in this case): 1. open the the vcenter service appliance (https://vcenter-ip:5480) log with root or admin account 2. in Syslog section add the receiver: IP, protocol, port (check if it works with "Send test message") The receiver could be a machine with UF or HF where you configured a syslog service (rsyslog or syslog-ng) so you adhere to the splunk best practices (use file instead of network connection). As i remember the next step is setting the level of log from General in vsphere environment. I'm not really sure cause not an expert in VMware, if you need the Alerts they can be sent with SNMP Traps. Have you had a look to splunkbase as well?   ... View more

Splunk on its own is not a monitoring solution, but data gathering and processing one. So if you just store measurements of some performance parameters it doesn't know on its own if they are "good" or "bad". It's up to you to tell Splunk how to make sense of this data. You probably can use apps which might have some of this functionality predefined already but that will depend on what you want to monitor. You can also check ITSI (paid premium app, probably not what you're looking for at the moment) or IT Essentials Work. ... View more

OK. I got a bit too far ahead of myself 🙂 The TZ setting is only applied if there is no timezone specified within the timestamp parsed from the event so in your case this setting - even though it is set - will not apply because you have your "IST" in your time string. Time is generally being parsed on the first "heavy" (based on a full installation, not the universal forwarder binary) component in event's path. So if you're sending your events straight from UF to indexers, the events are parsed on indexers (including timestamp recognition and parsing). If you're sending them from UF to HF(s) which are sending to indexers, parsing is done on HFs. And on those parsing components (in the first case - indexers, in second - on HFs) you need the TZ_ALIAS config. So if you deploy your config only to UFs, it won't work since UFs don't parse events. They just read/receive them (depending on the type of input) and forward them to indexers/HFs. ... View more