Hello, 1. Verifiy the configuration web.conf [settings] max_upload_size = 2000 2. Restart Splunk 3. Verify configuration in the memory /opt/splunk/bin/splunk show config web | grep max_upload_size 4. Try upload the file Now. Thank you! ... View more

Hello, |makeresults format=csv data="student_id,student_name,class,school,subject,score 1,Alice,10A,School1,Math,85 2,Bob,10A,School1,Math,72 3,Charlie,10B,School1,Science,90 4,David,10A,School2,Math,65 5,Eva,10B,School2,Science,88" | top score class school | streamstats count as ClassLevel by class | streamstats count as SchoolLevel by school   Thank You! ... View more

Hello,   Try modify   $SPLUNK_HOME/etc/apps/search/appserver/static/appLogo.png  $SPLUNK_HOME/etc/apps/search/appserver/static/appLogo.gif Thank You! ... View more

Hello, +++++++++++++ Indexer Cluster + +++++++++++++ Via GUI ======== cluster-manager -------------- Settings -> Indexer Clustering -> Enable indexer clustering -> Manager node -> Replication Factor : 2 Search Factor : 2 Security Key :passkey123 Cluster Label : Cluster1 Click -> Enable Manger Node Peer Node ---------- Settings -> Indexer Clustering -> Enable indexer clustering -> Peer node Manager URI : https://managerip:8089 [Cluster manager] Peer replication port : 8080 Security key : passkey123 Click -> Enable Peer Node Search head node ---------------- Settings -> Indexer Clustering -> Enable indexer clustering -> Search head node Manager URI : https://managerip:8089 Security key : passkey123 Click -> Enable Search head Node Via Config File: ======== Manager: -------- server.conf [clustering] mode = manager replication_factor = 2 search_factor = 2 pass4SymmKey = passkey123 cluster_label = cluster1 Peer Node: ---------- server.conf [replication_port://8080] [clustering] manager_uri = https://managerip:8089 mode = peer pass4SymmKey = passkey123 Search Head: ------------ [clustering] manager_uri = https://managerip:8089 mode = searchhead pass4SymmKey = passkey123 Via Cli ======= Manager Node: -------------- ./splunk edit cluster-config -mode manager -replication_factor 2 -search_factor 2 -secret passkey123 -cluster_label cluster1 ./splunk restart Peer Node: ---------- ./splunk edit cluster-config -mode peer -manager_uri https://managerip:8089 -replication_port 8080 -secret passkey123 ./splunk restart Search Head: ------------ ./splunk edit cluster-config -mode searchhead -manager_uri https://managerip:8089 -secret passkey123 ./splunk restart ./splunk show cluster-status +++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++ Searh Head Cluster ++++++++++++++++++ Deployer ------------ server.conf [shclustering] pass4SymmKey = yoursecuritykey shcluster_label = shcluster1 SH --- /opt/splunk/bin/splunk init shcluster-config -auth admin:changed -mgmt_uri https://sh1.example.com:8089 -replication_port 8887 -replication_factor 2 -conf_deploy_fetch_url https://deployerip:8089 -secret yoursecuritykey -shcluster_label shcluster1 [Repeat On all SH only by changing mgmt_uri] Once done in All SH. Choose captain. /opt/splunk/bin/splunk bootstrap shcluster-captain -servers_list "https://sh1.example.com:8089,https://sh2.example.com:8089,https://sh3.example.com:8089,https://sh4.example.com:8089" -auth admin:changed Check Status /opt/splunk/bin/splunk show shcluster-status Thank You! ... View more

Hello, Try restart, if you have not done [SELINUX settings to apply]>   [/usr/lib/systemd/system/SplunkForwarder.service] OR [/etc/systemd/system/SplunkForwarder.service] [Service] MemoryLimit=16542720000 [16 GB In Byte | modify as per your system memory ] sudo systemctl daemon-reload sudo systemctl restart SplunkForwarder Thank You! ... View more

Hello,   Confirm the below,   1. No issues  with Network bandwidth [QOS] 2. Splunk Syslog/Syslog-NG/rsyslog which one are you using? 3. View the data with packet capturing, monitor the timestamp in the data.   ... View more

Hello, Did you make the entry for the srv and ver fields in fields.conf? Thank You! ... View more

Hello, Try Ingest action, if you want to process [mask/filter] the data. Use Route to Destination Rule. Else  go with multiple target in outputs.conf  [tcpout] defaultGroup=cloned_group1,cloned_group2 [tcpout:cloned_group1] server=10.10.10.1:9997, 10.10.10.2:9997, 10.10.10.3:9997 [tcpout:cloned_group2] server=10.1.1.197:9997, 10.1.1.198:9997, 10.1.1.199:9997, 10.1.1.200:9997 Thank You! ... View more

Hello, Mask using regex , Filter using regex and EVAL can be achievable.  This can help you lot.  https://help.splunk.com/en/splunk-cloud-platform/get-started/splunk-validated-architectures/getting-data-in-forwarding-and-preprocessing/ingest-actions-for-splunk-platform Mask, redact, remove, or otherwise change raw data before indexing Tag, add, lookup, or otherwise augment raw data before indexing Thank You! ... View more

Hello,   Hope below example help for you! 1st Option Transform. [session-anonymizer] REGEX = (?m)^(.*)SessionId=\w+(\w{4}[&"].*)$ FORMAT = $1SessionId=########$2 DEST_KEY = _raw 2nd option is Ingest actions. If both not helpful, explain more about the requirement .  Thank you! ... View more

Hello,   I have another option. If you can... try this one. https://splunkbase.splunk.com/app/7404 Thank You! ... View more

Hello maheshnc, If you use HF to receive syslog, it will receive the log, process it, and store it in the indexers. It wouldn't store in HF.  To archive it, Settings → Data Inputs. Find the TCP and/or UDP input options under Network data. Add new for TCP or UDP. Choose the port you want to use. Assign a sourcetype. Choose or define the index. Optionally set host settings. Else, if you want to use UF, set up syslog-ng and store the logs in files and read them using UF by setting up inputs.conf. Difference: UF does not do full parsing, routing based on event content. Transformation/filters that require deep processing. It usually has minimal functionality.It is a lightweight component. HF is a full Splunk Enterprise install that is used as a forwarder. Indexing is typically disabled (or you configure it so it doesn’t index locally) when being used as HF. It can parse, filter, route, transform and mask/anonymize events before forwarding. Thank you! ... View more