@isoutamo @PickleRick  you mean that Once logs transition to frozen storage, they are typically outside Splunk's control unless you have configured specific mechanisms to manage them.  can I  handle frozen storage  using Automate Deletion of Old Frozen Data Example: Delete Frozen Data Older Than 1 Year #!/bin/bash # Path to the frozen storage directory FROZEN_DIR="/data/splunk_frozen" # Log file for the operation LOGFILE="/var/log/splunk_frozen_cleanup.log" # Retention period in days (365 days = 1 year) RETENTION_DAYS=365 # Find and delete directories older than the retention period echo "$(date): Starting cleanup of frozen data in $FROZEN_DIR" >> "$LOGFILE" find "$FROZEN_DIR" -type d -mtime +$RETENTION_DAYS -exec rm -rf {} \; -exec echo "$(date): Deleted {}" >> "$LOGFILE" \; echo "$(date): Cleanup complete" >> "$LOGFILE"   ... View more

Hi @gcusello    What stanza should I insert in inputs .conf to monitor all the client accesses to the DC? and what do you mean by local events? ... View more

Hi @gcusello , did you mean that  should need to enable the below stanza: ###### Monitor Inputs for DNS ###### [MonitorNoHandle://$WINDIR\System32\Dns\dns.log] sourcetype=MSAD:NT6:DNS disabled=1 "While monitoring DNS logs directly with Splunk Universal Forwarder is effective, some articles suggest using Splunk Stream Forwarder apps to enhance log efficiency and analysis capabilities. what is the best practice?   ... View more

Hi @gcusello  i noticed that Splunk does not support the Add-on for WorkspaceOne.and has no documentation. is there any supported app to parse the Vmware workspace one-MDM   ... View more

Hi @gcusello  could you please provide me with the stanza to change the interval required to read logs from the log file?   ,EX MSSQL-  ERROR.log file  ... View more

Hi @gcusello  what about reading log from application log files? is it continuously monitoring or can we make it interval?   ... View more

Hi @gcusello  many thanks ,appreciate your support ... View more

Thank you @gcusello for your reply. Our customer has asked me about the recommended log level that should be sent, for example, from Palo Alto to Splunk. Do you have any answer for this?" ... View more

hello @isoutamo  please advise the load balancing method connectivity from source IP to go to the forwarder node .. the persistency or we can keep it round robin? we have 2 forwarders ... View more

Hello @gcusello  please advise the load balancing method connectivity from source IP to go to the forwarder node .. the persistency or we can keep it round robin? we have 2 forwarders ... View more

Hello @gcusello  regarding your question: There's only one not clear thing: why are you speaking of a single intermediate Forwarder? No, I have 2 forwarders, but as you know, since UDP is a stream, one forwarder will handle all traffic. ... View more

Dear @gcusello  I have already configured rsyslog on both intermediate forwarders and need to set up the load balancer to receive traffic from syslog devices and forward it to a single backend intermediate forwarder. If the load balancer administrator asks, what is the best practice for configuring the load balancer to forward traffic to our intermediate forwarder? ... View more

many thanks @jawahir007  ... View more

thank you @gcusello  for your reply i need to clarify that we are in setting architecture phase and our customer  asked me the below questions and I need to reply with specific recommended B/W   What is the recommended bandwidth between intermediate forwarders, heavy-weight forwarders, and indexers? What is the recommended bandwidth between the UF agents and indexers?" ... View more