Hi @livehybrid,   Thanks for this. I looked at the parsing documentation earlier. Is there not a simpler way to do this as I don't need to rewrite fields etc as I have a TA doing it. All I need is if syslog from this HOST/IP then send to index=opnsense, is this achievable with one parser config or is what you already stated the only way of doing it? ... View more

Hello,   Yes case sensitivity was an issue. I could only get the command to run in CLI if SC4S was in upper case but if it is Upper or Lower case in the script it always exits 1regardless of running state. ... View more

Hi @livehybrid    Apologies I got side tracked by another project and just coming back to this. I am stuck and cannot get this check script to work. I have even tried a simpler "if else " statement but don't seem to get the desired affect. If I change your script to echo rather than exit I get the echo reply I am expecting if the sc4s container state is started or stopped but as soon as it is using exit statements it always exits 1. Below is what I have done, hoping you can spot my mistake. ----------sc4s_health_check_script.sh---------- Only change is making sc4s upper case # Example keepalived health check script #!/bin/bash # Check if SC4S container is running podman ps --filter "name=SC4S" --filter "status=running" | grep SC4S > /dev/null 2>&1 || exit 1 # Check if syslog port (e.g., 514) is listening ss -ltn | grep ':514 ' > /dev/null 2>&1 || exit 1 exit 0   ----------Keepalived.conf---------- vrrp_script sc4s_health_check { script "/etc/keepalived/sc4s_health_check_script.sh" interval 2 weight -20 } track_script { sc4s_health_check }   This is what I get from keepalived and no matter what I change it always returns 1  Keepalived_vrrp[11414]: VRRP_Script(sc4s_health_check) succeeded Keepalived_vrrp[11414]: Script `sc4s_health_check` now returning 1 Keepalived_vrrp[11414]: VRRP_Script(sc4s_health_check) failed (exited with status 1) keepalived_vrrp[11414]: (VI_1) Changing effective priority from 254 to 234   ... View more

@gcusello thanks that is exactly what I needed  ... View more

Hi @gcusello  How does this stop the filter from stopping access to all the other indexers the user has access to? As soon as I add the filter " host::spl001 OR host::spl002 " for example it will apply this restriction to all indexes not jus the _internal I want it to wont it? ... View more

@kiran_panchavat Thanks, this helps  ... View more

This was indeed the issue. Thank you so much for the help. ... View more

Just to add to this I doubled the RAM in my dev environment for the VM to 24GB and still get the same error ... View more

This is the full error output,   Migrating to: VERSION=9.2.0.1 BUILD=d8ae995bf219 PRODUCT=splunk PLATFORM=Linux-x86_64 ********** BEGIN PREVIEW OF CONFIGURATION FILE MIGRATION ********** Traceback (most recent call last): File "/opt/splunk/lib/python3.7/site-packages/splunk/clilib/cli.py", line 39, in <module> from splunk.rcUtils import makeRestCall, CliArgError, NoEndpointError, InvalidStatusCodeError File "/opt/splunk/lib/python3.7/site-packages/splunk/rcUtils.py", line 17, in <module> from splunk.search import dispatch, getJob, listJobs File "/opt/splunk/lib/python3.7/site-packages/splunk/search/__init__.py", line 17, in <module> from splunk.rest.splunk_web_requests import is_v2_search_enabled File "/opt/splunk/lib/python3.7/site-packages/splunk/rest/splunk_web_requests/__init__.py", line 1, in <module> import cherrypy File "/opt/splunk/lib/python3.7/site-packages/cherrypy/__init__.py", line 76, in <module> from . import _cprequest, _cpserver, _cptree, _cplogging, _cpconfig File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpserver.py", line 6, in <module> from cherrypy.process.servers import ServerAdapter File "/opt/splunk/lib/python3.7/site-packages/cherrypy/process/__init__.py", line 13, in <module> from .wspbus import bus File "/opt/splunk/lib/python3.7/site-packages/cherrypy/process/wspbus.py", line 66, in <module> import ctypes File "/opt/splunk/lib/python3.7/ctypes/__init__.py", line 551, in <module> _reset_cache() File "/opt/splunk/lib/python3.7/ctypes/__init__.py", line 273, in _reset_cache CFUNCTYPE(c_int)(lambda: None) MemoryError Error running pre-start tasks ... View more

I have tried both the preview and upgrading without doing the preview. It is after running the start command that it errors. In preview mode I get the same error it just takes a lot longer to get to the error. - rpm -U splunk_package_name.rpm - $SPLUNK_HOME/bin/splunk start ... View more

Hi Marnell,   Yes this error is happening on my 2 HF's and deployment servers. All have 12GB of RAM with 10GB available. ... View more