Hello, Try restart, if you have not done [SELINUX settings to apply]>   [/usr/lib/systemd/system/SplunkForwarder.service] OR [/etc/systemd/system/SplunkForwarder.service] [Service] MemoryLimit=16542720000 [16 GB In Byte | modify as per your system memory ] sudo systemctl daemon-reload sudo systemctl restart SplunkForwarder Thank You! ... View more

Hello,   Confirm the below,   1. No issues  with Network bandwidth [QOS] 2. Splunk Syslog/Syslog-NG/rsyslog which one are you using? 3. View the data with packet capturing, monitor the timestamp in the data.   ... View more

Hello, Did you make the entry for the srv and ver fields in fields.conf? Thank You! ... View more

Hello, Try Ingest action, if you want to process [mask/filter] the data. Use Route to Destination Rule. Else  go with multiple target in outputs.conf  [tcpout] defaultGroup=cloned_group1,cloned_group2 [tcpout:cloned_group1] server=10.10.10.1:9997, 10.10.10.2:9997, 10.10.10.3:9997 [tcpout:cloned_group2] server=10.1.1.197:9997, 10.1.1.198:9997, 10.1.1.199:9997, 10.1.1.200:9997 Thank You! ... View more

Hello, Mask using regex , Filter using regex and EVAL can be achievable.  This can help you lot.  https://help.splunk.com/en/splunk-cloud-platform/get-started/splunk-validated-architectures/getting-data-in-forwarding-and-preprocessing/ingest-actions-for-splunk-platform Mask, redact, remove, or otherwise change raw data before indexing Tag, add, lookup, or otherwise augment raw data before indexing Thank You! ... View more

Hello,   Hope below example help for you! 1st Option Transform. [session-anonymizer] REGEX = (?m)^(.*)SessionId=\w+(\w{4}[&"].*)$ FORMAT = $1SessionId=########$2 DEST_KEY = _raw 2nd option is Ingest actions. If both not helpful, explain more about the requirement .  Thank you! ... View more

Hello,   I have another option. If you can... try this one. https://splunkbase.splunk.com/app/7404 Thank You! ... View more

Hello maheshnc, If you use HF to receive syslog, it will receive the log, process it, and store it in the indexers. It wouldn't store in HF.  To archive it, Settings → Data Inputs. Find the TCP and/or UDP input options under Network data. Add new for TCP or UDP. Choose the port you want to use. Assign a sourcetype. Choose or define the index. Optionally set host settings. Else, if you want to use UF, set up syslog-ng and store the logs in files and read them using UF by setting up inputs.conf. Difference: UF does not do full parsing, routing based on event content. Transformation/filters that require deep processing. It usually has minimal functionality.It is a lightweight component. HF is a full Splunk Enterprise install that is used as a forwarder. Indexing is typically disabled (or you configure it so it doesn’t index locally) when being used as HF. It can parse, filter, route, transform and mask/anonymize events before forwarding. Thank you! ... View more