for today this is the volume used there are 3 indexers each one of them has 16 CPU's ... View more

thanks @gcusello  for responding,   i didn't miss up with disk storage or add any additional partitions .. last week i performed a new index from the CM and push it through indexers ...   about IOPS i don't know how can i check that using splunk   for the virtual infrastructure splunk has it's own configuration and not shared with other resources ... (Vsphere) ... View more

i have checked the main partitions of the system and hot/cold/frozen partition they have enough space and i think it's not the issue...   Thanks @gcusello  ... View more

how can i solve it the disk volume high but how can i ensure the data can be aligned is there commands or something to check ? ... View more

i have checked everything and it's appears the splunk saying connectivity issue but there is no issues. i think it's require support from splunk it self .... ... View more

Yes, That's true i got connectivity issue from an indexer and the problem happened surprisingly without any circumstances before    could you help ? ... View more

i did the rolling restart nothing happened the issue still persists and i don't know why it's happened ... ... View more

i got many errors some of them indicating connection issues between one peer and cluster master when i checked everything ok    do i miss anything? ... View more

tbh, i tried more than 2 day's to fix this situation i end up with SEDCMD i look at the event field extractions and it's appears good enough i know what are you referring if there is quotes already persent it will miss with key=value fields    any ways thanks for everything now i'm facing such headche problem batch adding issue with indexers and i think it's because the bandwith of the end-points . @PickleRick  ... View more

if the key=value the value has space it will quote it so splunk can parse it without any issue if there is no space splunk already knows key=value so he will parse the information without any issue .   @PickleRick thanks for your helping now i'm facing big problem regarding batchadding 😧 ... View more

I did this regex using SEDCMD on HF before sending data to indexers  s/(\w+)=([^\s"][^"\r\n=]*\s[^\r\n=]*)(?=\s|$)/\1="\2"/g     ... View more

i fixed the issue by using regex With SEDCMD command on HF to fix the parsing and now everything is good   thanks for help @PickleRick  ... View more

this is a sample of event  <149>Jul 23 18:54:24 fireeye.mps.test cef[5159]: CEF:0|fireeye|HX|4.8.0|IOC Hit Found|IOC Hit Found|10|rt=Jul 23 2019 16:54:24 UTC dvchost=fireeye.mps.test categoryDeviceGroup=/IDS categoryDeviceType=Forensic Investigation categoryObject=/Host cs1Label=Host Agent Cert Hash cs1=fwvqcmXUHVcbm4AFK01cim dst=192.168.1.172 dmac=00-00-5e-00-53-00 dhost=test-host1 dntdom=test deviceCustomDate1Label=Agent Last Audit deviceCustomDate1=Jul 23 2019 16:54:22 UTC cs2Label=FireEye Agent Version cs2=29.7.0 cs5Label=Target GMT Offset cs5=+PT2H cs6Label=Target OS cs6=Windows 10 Pro 17134 externalId=17688554 start=Jul 23 2019 16:53:18 UTC categoryOutcome=/Success categorySignificance=/Compromise categoryBehavior=/Found cs7Label=Resolution cs7=ALERT cs8Label=Alert Types cs8=exc act=Detection IOC Hit msg=Host test-host1 IOC compromise alert categoryTupleDescription=A Detection IOC found a compromise indication. cs4Label=IOC Name cs4=SVCHOST SUSPICIOUS PARENT PROCESS   i need to do field extractions and make the event display all the data without truncating inside the details of event ... View more

could you help me with examples please ? cuz i tried to find an app for Trellix hx end-point security but i can't find it    THANKS ... View more

is there another options for parsing like editing props.conf since i don't want to add new app    is there any possibility for this type of events to just edit props.conf?   my props.conf [trellix] category = Custom pulldown_type = 1 TIME_FORMAT = ^<\d+> EVAL-_time = strftime(_time, "%Y %b %d %H:%M:%S") TIME_PREFIX = %b %d %H:%M:%S ... View more

it's like this  <149>Jul 23 18:54:24 fireeye.mps.test cef[5159]: CEF:0|fireeye|HX|4.8.0|IOC Hit Found|IOC Hit Found|10|rt=Jul 23 2019 16:54:24 UTC dvchost=fireeye.mps.test categoryDeviceGroup=/IDS categoryDeviceType=Forensic Investigation categoryObject=/Host cs1Label=Host Agent Cert Hash cs1=fwvqcmXUHVcbm4AFK01cim dst=192.168.1.172 dmac=00-00-5e-00-53-00 dhost=test-host1 dntdom=test deviceCustomDate1Label=Agent Last Audit deviceCustomDate1=Jul 23 2019 16:54:22 UTC cs2Label=FireEye Agent Version cs2=29.7.0 cs5Label=Target GMT Offset cs5=+PT2H cs6Label=Target OS cs6=Windows 10 Pro 17134 externalId=17688554 start=Jul 23 2019 16:53:18 UTC categoryOutcome=/Success categorySignificance=/Compromise categoryBehavior=/Found cs7Label=Resolution cs7=ALERT cs8Label=Alert Types cs8=exc act=Detection IOC Hit msg=Host test-host1 IOC compromise alert categoryTupleDescription=A Detection IOC found a compromise indication. cs4Label=IOC Name cs4=SVCHOST SUSPICIOUS PARENT PROCESS   this as a raw data but when i try to expand the details of event i see it's truncated . i will provide you with the config i did inside HF this morning.   Thx ... View more

@batabay when i did your command about firewall-cmd i got the port that has syslog not inside allowed port to forward ... View more