Did this work? Did you discover that you had to implement additional steps to make it work?   Thanks, Farhan ... View more

Thanks @codebuilder  Not exactly sure how, but it started working. I can only think the restart (although a few times) must have fixed this.   ... View more

Hi @johnlzy0408, the first test is using telnet from UF: telenet ip_indexer 9997 If you cannot connect on Indexer on port 9997 you could have the following issues: you didn't enabled receiving on Indexer, but, you said that you're receiving from other UFs, so this issue should be excluded; there's a local firewall on Indexer, , but, you said that you're receiving from other UFs, so this issue should be excluded; there's a Firewall between UF and Indexer; there's a local Firewall on UF, outputs.conf on UF isn't correct. I can help you to check only the last issue: could you share your outputs.conf? try to use the outputs.conf of another UF that's running. Ciao. Giuseppe ... View more

I have this error on Mac OS too, Tried on Splunk 8.0 and  8.1, with Add-on 3.0.1. 😐 Edit:  Actually my error is slightly different, I get the below when adding the input, and input is not created Argument validation for scheme=azure_event_hub failed: The script returned with exit status 1.   ... View more

AFAIK, Symantec does not support HEC, but you could write your own program/script that reads Symantec data and converts it to HEC. ... View more

As suggested above, Splunk docs links above are the best place for updated information for exact version you are on. But the below is very useful for SSL setup across all Splunk components, although some configurations are deprecated now and you will need to use the new config as suggested in Splunk docs for those. https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPractices.pdf ... View more