To op were you able to get this working?  ... View more

I pushed out a new release into the repo: https://github.com/AlaskaSSO/TA-meraki/releases/tag/v1.1.2 If it looks good I'll push it up to the splunk app store. ... View more

Sorry about the long delay. I updated the details section of the app. ... View more

Sorry for the long delay. Apparently my subscriptions to be notified of forum posts regarding this tag was not working. 1 On our Heavy Forwarder, we can add a different UDP port for this data. Meraki can also forward on this port. Do we need to install the app on the heavy forwarder? Yes and no (optional). There is one piece that executes on index "TRANSFORMS-meraki_date_clipper". Basically all it does is clip out the unix timestamp in preference to the syslog timestamp. Completely unnecessary (unless you want to save a few bytes in your log). 2 Do we need to also install the app in the cloud? Yes 3> Or should we only install in the cloud and add the port on the heavy forwarder and force the sourcetype for that port to be “meraki”? You'll still need the sourcetype by Meraki, which would be done on your heavy forwarder... but you'll need this on your search head (i.e. the cloud) ... View more

What about configuring meraki to send on a different port than 514 and just force all incoming data on that port to type meraki? ... View more

I currently run 14 indexers over ~250 spinning disks with raidz2. I've been running splunk over zfs for over 3 years. No problems, in fact I initially ran indexers with several different backends and zfs was the most stable. My main indexer is a 1U supermicro box with a cost of ~5k. Box has 12 spinning media drives (raidz2), used Hitachi Ultrastar drives. 2 SSD's for bootup disks. Then install a PCI NVMe drive for your cache drive. (2-4 or so gigabytes per second speed). I'd recommend altering the default settings of zfs so it'll be more aggressive with using the NVMe drive. Get at least 12 cores in order to remove the annoyance about Enterprise Security complaining <12 cores. ... View more

This was mistakenly added to the docs, and was removed when it was discovered that QA had not completed tested Splunk on top of ZFS. ... View more

I did a GeoASN install in a distributed environment today and had sismilar problems. Solution: Install all the components (listed in the README) and the app on all searchheads and indexers. ... View more