About henry_collins

henry_collins

I think that's a really helpful summary. The biggest takeaway is that /event expects already-defined JSON events, so event breaking settings aren't used, while /raw goes through the normal parsing pipeline where props.conf settings like LINE_BREAKER and SHOULD_LINEMERGE matter. Keeping that distinction in mind makes it much easier to choose the right endpoint for your data.

henry_collins

If the fields show up in a normal SPL search but fail validation in Exposure Analytics, it's often because EA expects those fields to exist at index time or in a specific data model, not just as search-time extractions. Double-check that your sourcetype mapping and required field names match exactly what EA expects. I don't think there's much official documentation for onboarding custom data sources, so the Splunk docs and community posts are probably your best references unless Splunk Support can share internal guidance.

henry_collins

The main issue is not the field filtering itself, but where the pipeline is running and how Splunk is classifying the event afterward. Changing sourcetype in a pipeline won’t necessarily make Splunk treat it as a Palo Alto CIM/add-on event again, especially after modifying _raw. A better approach is to keep the original sourcetype and remove unwanted fields before indexing, rather than rebuilding the event structure. Also check that the destination index and source type mappings are still tied to the Palo Alto add-on inputs. Your custom pipeline proves the filtering works, so focus on preserving the metadata (sourcetype, source, index routing) instead of converting the event. You may also want to compare _meta values before and after the pipeline to see what is being lost.

henry_collins

If the TA is designed to use Splunk's credential storage, then show-encrypted is usually the right approach, even if the TA itself isn't Splunk-supported. The key thing is to check the TA's documentation or configuration to see how it expects secrets to be stored. If it specifically asks for plain text or has its own encryption method, follow that instead.

henry_collins

If you're using an Indexer Cluster, I'd treat the Cluster Manager as the single source of truth for indexes.conf. Even if local copies worked in older versions, they're not the recommended approach and can lead to inconsistencies during startup or recovery. I'm not aware of a specific 9.3.x change that made local deployment invalid, but stricter validation or timing changes could certainly expose configuration drift that previously went unnoticed. Move the configuration into the cluster bundle first, then see if the recovery issue still occurs.

henry_collins

If you want Windows Security logs without installing the Universal Forwarder, you can use Windows Event Forwarding (WEF) to collect the events on a central Windows server and then have Splunk ingest them from there. Another option is using an agentless solution via WinRM or similar tools, but WEF is usually the most practical and reliable approach for Security logs.

henry_collins · ‎07-14-2026

In a multisite cluster, Splunk’s replication placement logic doesn’t really optimize based on link speed or latency. It follows the site replication or search factor rules and the bucket copies available, not network topology awareness. The usual approach is to design the site configuration so copies are distributed in a way that matches your network layout. If you have very uneven links, you may need to rethink the site architecture rather than rely on Splunk to pick the “closest” peer. There isn’t a simple setting that forces site1 to always pull from the fastest site2 peer instead of site3. Network optimization usually comes from proper capacity planning, site definitions, and ensuring the desired copies exist where you need them.

henry_collins · ‎07-08-2026

If you're on Splunk Cloud, you can still use the appserver/static approach, but you typically deploy it as part of your app rather than copying files directly to the filesystem. Once the image is packaged with the app, you can reference it from your Classic Dashboard. If you don't manage app deployments yourself or run into restrictions, Splunk Cloud Support is the right place to confirm the supported deployment method.

Posts	8
Solutions	1
Karma Given	31
Karma Received	6
Member Since	‎06-22-2026

Online Status	Offline
Date Last Visited	a month ago

Re: Note about how HEC events are parsed based on ...

Re: Exposure Analytics - Manual Data Sources

Re: Ingest Processor doesn't route logs where I wa...

Re: Can I use the Splunk encryption tool to encryp...

Re: [Indexer Cluster] indexes.conf Deployment Loca...

Re: How to onboard the logs from windows to Splunk...

Re: optimizing Splunk multisite indexer replicatio...

Re: How to Add an Image to a Splunk Classic Dashbo...

Join the Conversation