Is there a limitation on number of installation of Universal forwarder in Hosting environment (Server) assuming i have relevant license available? ... View more

Hi Rich, Thank you for your help, that did it! ... View more

Thank you. ... View more

Thank you! ... View more

Hi @PaveIP, Due to Splunk supports suggestion to correct this ERROR, I followed your first solution and edited the interfaces.sh file. This has worked and I am no longer receiving the error on the Linux machine. Thank you for your help! ... View more

Hi Rich, thank you for your help. Looking in Splunkd.log helped point us in the right direction. I included the steps we took to correct the issue. ... View more

You will need to nullqueue these events. These look like process monitoring events, so dropping just the events with your noisy process is the way to go. I am going to assume these arrive with the sourcetype=proccess_logs. I am also going to assume that whilst you have version 5.7 installed today it could be 6.0 in the future. On your HF, or Indexers (whichever occurs first in the Splunk event flow path) props.conf [proccess_logs] TRANSFORMS-drop_cctv_events=drop_cctv_events transforms.conf [drop_cctv_events] REGEX=ProcessName\=.+camera\ssystem\scenter\s\d\.\d\\camerasystem\.exe DEST_KEY=queue FORMAT=nullQueue This will only apply for data arriving from the time of the change, but this should prevent these logs being indexed in the future. ... View more