We cannot change the config at UF. ... View more

How did you solve this problem? ... View more

More details on how to managed logs for _internal . The _internal index are populated by the following stanzas: $SPLUNK_HOME/etc/default/inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk] [monitor://$SPLUNK_HOME/etc/splunk.version] $SPLUNK_HOME/apps/SplunkUniversalForwarder/default/inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log] [monitor://$SPLUNK_HOME/var/log/splunk/metrics.log] If we want to forward the logs only to "prod-group" then create the following in $SPLUNK_HOME/etc/system/local/inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk] _TCP_ROUTING = prod-group [monitor://$SPLUNK_HOME/etc/splunk.version] _TCP_ROUTING = prod-group [monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log] _TCP_ROUTING = prod-group [monitor://$SPLUNK_HOME/var/log/splunk/metrics.log] _TCP_ROUTING = prod-group ... View more

Take a look at this thread. https://answers.splunk.com/answers/319215/after-upgrading-windows-forwarders-from-splunk-611.html If the UF is newly upgraded, it could be the case of manual upgrade includes auto creation of TA_windows. ... View more

Just by reading the error message, it seems that your UF may also be pointing to a Deployer. Check the forward-server list of the UF. ... View more

Here is how to get the Chat ID Step 1. Enter the following command on your browser. Use your Bot Token (it's the long token) https://api.telegram.org/bot<yourtoken>/getUpdates Step 2. Look at the result. You should see your chat id If you cannot see your chat id, remove your bot from the chat and add it back. Resend the command and you will see the chat id. Take note that the chat id includes the minus sign. For completeness, this is what you should do to get a Bot Id. 1. Add BotFather as your contact in Telegram 2. Chat with BotFather and request a new bot by running /newbot You should get a long token. This is your Bot Id. 3. Create a group chat in Telegram and your bot into the group. ... View more

There are two problems with Cisco Security Suite v312 using Cisco eStreamer eNcore addon for Splunk v300 (for FMC v6). The first one is Cisco Security Suite expects logs in index called estreamer. The solution is create inputs.conf under opt/splunk/etc/apps/TA-eStreamer/local/ [monitor://$SPLUNK_HOME/etc/apps/TA-eStreamer/data] disabled = false index = estreamer [script://./bin/splencore.sh start] disabled = 0 index = estreamer [script://./bin/splencore.sh status] disabled = 0 index = estreamer The second problem is the macro used in Cisco Security Suite. The solution is to create etc/apps/Splunk_CiscoSecuritySuite/local/macros.conf [SfeS-index] definition = index=estreamer [SfeS-estreamer-logs] definition = `SfeS-index` sourcetype=cisco:estreamer:data [SfeS-client-check-logs] definition = `SfeS-index` sourcetype=cisco:estreamer:status ... View more

I had the same problem and figured out that eventhough my alert is no longer shown on GUI but it is still stored in a file. Here is what I did. Step 1. Look for a file called savedsearches.conf In my mac, I run the following. find . -name "savedsearches.conf" Step 2. Look for the stanza that defines your alert. It looks like the following. [alert test] action.email.useNSSubject = 1 action.script = 1 action.script.filename = sendsms.sh ... Step 3. Remove the stanza. Step 4. Restart Splunk ... View more

This is what I do in order to put two panels into one panel. There are two sections in a single panel section: single and chart. <form> <label>My Dashboard</label> <fieldset submitButton="false" autoRun="false"> <input type="time" token="field1"> ... </input> <input type="dropdown" token="field2"> ... </input> ... </fieldset> <row> <panel> <title>Water Level by Time and Sensor</title> <single> <title>Active Sensors</title> <search> ... </search> </single> <chart> <title>Sensor Level</title> <search> ... </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> ... </chart> </panel> </row> </form> ... View more

I had the same problem on Windows 2012 and solved it by doing the following: 1. Open Command Prompt as Administrator and Run msiexec /i splunkfilename.msi 2. Enter username in the form of Domain\username ... View more