Request a feature on ideas.splunk.com, asking for support of more than 1 SAML IDP.   ... View more

Actually you have to adapt the local.meta from the search app. It has been tested with 8.0.3 1. edit local.meta vi /opt/splunk/etc/apps/search/metadata/local.meta 2. add the following line: [views/job_manager] access = read : [ admin ], write : [ admin ] export = system owner = admin   ... View more

Just an update, I was able to resolve this issue. It turned out to be a janky network fw rule that was blocking certain traffic. Once our network admins removed the janky rule we ere able to successfully send logs to splunk. We were able to identify this was a FW issue once we noticed that we couldn't get to any single sign on sites (gmail, okta, aws console etc..) from the problematic servers. ... View more

Hi, Yes..i will try with this. Regards ... View more

Yes this file keeps getting re-written (in parts) , so splunk keeps having to re-read it over and over. all other files append, this was the one that does not thanks rob ... View more

When we ingest logfiles which contain Java we configure the linebreaker manually. This means that the whole java dump will be in one event instead of mixed up by the splunk auto parsing. In those cases our props.conf looks like this: [yoursourcetype] LINE_BREAKER = ([\r\n]+)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2} SHOULD_LINEMERGE = false TRUNCATE = 100000 MAX_TIMESTAMP_LOOKAHEAD = 30 NO_BINARY_CHECK = true TIME_FORMAT=%F %T TIME_PREFIX=^ LINE_BREAKER should contain the timestamp after the ([\r\n]+) and you probably want to increase TRUNCATE to at least 100000 ... View more

Interesting thing. When searching the props.conf page for input time We can see the ones that are strictly the input time ones, such as HEADER_MODE , the beloved CHARSET , obviously INDEXED_EXTRACTIONS , CHECK_FOR_HEADER and the famous NO_BINARY_CHECK . When searching for SHOULD_LINEMERGE the page doesn't say explicitly in which phase it takes place. ... View more

Try this one: LINE_BREAKER=([\r\n])\<ErrorMessage ... View more

It think the issue lies in the stanza definition. I had very bad experience with whitespaces in it. Just try [alert] as stanza ... View more

Hi @bobryant You said that you put the inputs.conf and props.conf on the UF. is that correct? If yes it's explainable why the linebreaking doesnt work. your props.conf should be located on the first Splunk Enterprise Instance. This instance is responsible for the parsing and will do the linebreaking and timestamp extraction. This can be either a HF or a Indexer. I just noticed that you use the BREAK_ONLY_BEFORE parameters. I would exchange it with LINE_BREAKER and SHOULD_LINEMERGE=false . This way you get more performance out of Splunk and is also best practice doing that. The config could look like this: [appx:ipro] LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}\.\d{3} MAX_TIMESTAMP_LOOKAHEAD = 30 NO_BINARY_CHECK = true SHOULD_LINEMERGE = false ... View more

Thanks for your answer. But as MuS expected doesn't it reflect my question. Lets start in the beginning. Datamodels are great to structure unstructured data. We all know what they are and how to create them or us them from the CIM. Accelerated datamodels are created with a scheduled search, which run every 15min for a defined searchrange. Those models use additional storage on the indexers and of course CPU power to create them. In fact they are resourceful. Because the creation of accelerated datamodels is expensive, they must have a added value. In my opinion the value is that the data is accessible much faster. But the only way to access those data is by using tstats | tstats summariesonly=t avg(foo) FROM datamodel=buttercup_games WHERE bar=value2 baz>5 But I don't only want to create stats of accelerated datamodels. I want to make searches on the data within the accelerated datamodel and get events out of it. Something like search datamodel=buttercup_games foo=value bar=value2 But there is no such command. so, why using accelerated datamodels if we only can make tstats and not properly search for events? ... View more

I had a lot of those warnings. mostly because of false breaking events. It may possible that you have adapt the LINE_BREAKER. another possibility is that the TIME_PREFIX to be change to this: TIME_PREFIX = \"t\":\" By the way this configuration goes to the Universal forwarder holding the logfiles: INDEXED_EXTRACTIONS = JSON ... View more

Hi @gedworksplunk I have some thoughts about your configuration. First of all NFS is not suggested by Splunk for using on the Indexers. If possible use local storage or reliable storage subsystem. In your setup you will only backup the replicated buckets, but you will never get the master buckets. So in your backup strategy you miss the original data. (Sitenote: We had some issues with replicated bucket when they were made searchable. Especially with buckets which contained Windows event logs) The backup strategy of Splunk is very simple, which is described here: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Backupindexeddata Just install a backup agent and implement Splunks recommendation. Another thought regarding Mulitsite Clustering Backup. If you backup all the data from each indexer you probably will backup more data as need. I would backup only the original buckets (db_) and write a blacklist for the replicated buckets (rb_). Why? The cluster will automatically replicate the original bucket if the clustermaster doesnt find any copies ... View more

well explained. ... View more

Hi yomesky2000, I will split the answer to your 4 questions into two answers: 1+2: Technically you can; should you do that? No! Your IDXC Master will be busy doing things its supposed to do and you will get issues as soon as your IDXC recovers for example. Also it is not recommended to do so, see the docs https://docs.splunk.com/Documentation/Splunk/latest/Deploy/Manageyourdeployment#Whether_to_colocate_management_components 3+4: Use a deployment server to configure the 2 HWF's so they use the same config files and enable forwarding using an outputs.conf config file, see the docs https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf#outputs.conf.example No, there is no clustering for HWF but using a deployment server and configuring a DNS round-robin CNAME that uses the IP's of both HWF's you get as close as possible, next you point your UF's to send to this CNAME. Don't use a physical load balancer in front of HWF for reasons, UF's can handle load balancing themselves and also the error handling of connections - which will a load balancer break if you put one in the Splunk-2-Splunk traffic. Hope this helps ... cheers, MuS ... View more