We have to pull logs from Tencent COS (Cloud Object Storage) to our Splunk instances which are hosted on AWS. Tencent team has provided the script for us but we are confused where to run this and where to write the configurations. Pls help. Below is our architecture: 1 Deployment server which maintains all the configurations and pushes to respective components through serverclass.conf. We have 2 cluster managers, 6 indexers, and one heavy forwarder which directly configured to indexers through indexer discovery.  When I am checking in chatgpt, it is giving multiple answers which I dont understand. it is asking to keep inputs.conf in default which I thought it is wrong it should be in local right? and how to avoid duplicate logs here? ... View more

Hi we have a splunk clustered environment hosted on AWS environment. Normally we are using Ssmsessionmanager role to login to instances and make the changes and day to day tasks. Now our organisation is asking not to use Ssmsessionmanager role anymore and start externalising our configurations from the instances and make instances stateless. And use the run command from SSM manager. I am not aware of all these. I have AWS CCP level knowledge and in mid of preparing SAA. I have zero knowledge on these things. How to proceed further on this? We have PS available not sure whether splunk can do this? Anyone with similar worked earlier? Please shed your thoughts. As of now, we have ami in dev environment, installing splunk in it and promoting to prod for every 45 days as a part of compliance. But we do on-boardings on weekly basis and we are using config explorer for that in frontend. But to create new integrations or creating HEC token we need access to prod environment and now they are not allowing at all. ... View more

Hello we have installed Akamai add-on on our HF and giving necessary monitor stanzas on its inputs.conf. we are using config explorer where we will perform all on-boarding actions from frontend itself. But somehow our HF UI is not loading at all these days frequently. Rest all components with same config explorer working fine. Not sure what is the issue. There are no errors found in splunkd.log. can someone help me with this? ... View more

I Need to exclude or discard specific field values which contains sensitive info from indexed events. Users should not see this data because this is password and needs to be masked or remove completely. But this password field will only come when there is field called "match_element":"ARGS:password" follows with password in field name called "match_value":"RG9jYXgtODc5MzIvKxs%253D" in this way. Below is the raw event -  "matches":[{"match_element":"ARGS:password","match_value":"RG9jYXgtODc5NzIvKys%253D","is_internal":false}], These are json values and given kv_mode=json in order to auto extract field values while indexing.  Here I need to mask or remove or override match values field values (RG9jYXgtODc5MzIvKxs%253D and soonnnn). Those are the passwords given by the user and very sensitive data which can be misued. I am afraid that if I do anything wrong.. Json format will disturb which in return all logs will be disturbed. Can someone help me with the workaround of this? ... View more