Hi All, I'm looking at configuring inputs for the Cisco ASA add-on on my UF as per; HERE My understanding was that the best practice was to send any Syslog streams to a Syslog server and then read the resulting output files with a file monitor. This seems to suggest you just sent directly to Splunk. How can I set up this add-in to use an inputs.conf file containing appropriate file monitors? Is that supported? Many thanks! M ... View more

Hi All, I've recently been looking at Splunk again after a few months away and have decided to look at using some TA add-ins. I understand in order to work the configuration files in a more managable way it is possible to extract (for example) the inputs.conf from several TA add-ins and combine in a custom app. Say for example I have the Splunk_TA_Windows add-in and the Splunk_TA_Cisco, both have an indexes.conf so rather than distributing two differnt files I could create an 'indexes' App and combine all settings in one file. Is that also possible with the inputs.conf file? Are there any issues breaking out input files from their original bundle into new Apps or should they be kept with their source files generally ? Thanks in advance, M ... View more

Hi All, I've been thinking for some time that I am not getting the performance I should be out of my Splunk setup and I'd like some advice for troubleshooting. Currently, I have a single Search Head, which is searching across two Indexers (non-clustered) and a few Universal Forwarders. They are all VMs, but with 4vCPUs and 10GB RAM and are idle most of the time. Forgetting the complete setup for now, I am focusing on a test which involved me stopping the services on Indexer 1 and clearing the indexes on it, including the fishbuket index. I have three inputs for Event Logs; - Application log going to an 'application' index - Security log going to a 'security' index - System log going to a 'system' index All indexes are defined in the indexes.conf I have configued the inputs.conf to collect local event logs on Indexer 1, so when I restart the services I expect it to start filling up the three indexes I have defined from the local Event Logs of the same name. This does happen, but really slowly - I think it Indexed about 300 Event Logs in 45 minutes. Does anyone have any idea why this would be slow and how I might troubleshoot it? Many thanks! M ... View more

Hi, I'm hoping someone can help me to understand if the following is possible with Splunk Enterprise as I'm just learning about the various components for a design I'm writing. The environment I'm working with will have around 100 Windows VMs initially, growing to 200+, probably across a few domains. There will also be networking devices to support that infrastructure which we want to be able to collect logs from as well. We are going to have two sites (active / passive) and I have two virtual servers in each site assigned to Splunk, although the DR site will be a standby. I'm trying to work with these two VMs without requesting more, although it may be possible to add more. From what I've read, I think I would be looking at a Data Consolidation topology i.e. multiple universal forwarders pushing data to an indexer / search server. If I wanted to consider high availability options within a single site, I might want to cluster the indexers, but as I only have two servers I'm wondering if it's possible to create a two node cluster hosting both the search and indexing roles? I don't think this is possible, as under the 'Cluster Nodes' guidance, it states that "Master nodes, peer nodes, and search heads are all specialized Splunk Enterprise instances. All nodes must reside on separate instances and separate machines." - this looks to me like I wouldn't be able to have a cluster with just two servers regardless. The other option I'm looking at would be to have one server as an Indexer and one as a search / indexer. Forwarders could then get data into the Indexers from the 100+ VMs. We do have DR options available and will be backing up, so high availability is not necessarily required and could be added later with increased demand. I suppose the questions are; 1) Is a clustering solution possible with two servers, or what would the minimum number of servers be? Could it be done with 3; two indexers and one search head, or would I need to have a seperate Master Node as well? 2) Am I right in thinking that if I had one server as an Indexer and one as an Indexer / search server, if the dedicated Indexer went down, the results would be incomplete? Furthermore, if the search server went down search would therefore be totally unavaiiable? 3) Is it possible to have two servers running as both Indexers and Search servers, or would I need a search head to manage both indexers in this case? Many thanks! M ... View more