Anyone get this fixed ? I have the same issues  ... View more

Is this an upgrade or initial install ?   if upgrade try rpm -ivh   <package name > —force  ... View more

RPM -ivh always works well for me . ... View more

Could you not use Rsyslog - if I understand the question - you want the syslog to create unique host information ? $template RemoteHost,"/var/syslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/syslog.log" Then apply this template to messages coming from remote hosts : $RuleSet remote . ?RemoteHost Then have Splunk then monitor the entire /var/syslog/hosts/ ... View more

with splunk down ... View more

See the follwing : Blockquote Splunk strongly recommends against using the CloudWatch Logs inputs to collect VPC Flow Logs data (source type: aws:cloudwatchlogs:vpcflow) since the input type will be deprecated in upcoming releases. Configure Kinesis inputs to collect VPC Flow Logs instead. The add-on includes index-time logic to perform the correct knowledge extraction for these events through the Kinesis input as well. Blockquote https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs ... View more

I run it on a CentOS search head without issue - as kmorris said the restriction seems to be if one wants to collect the local windows logs ( assumes WIndows search head ) ... View more

Tell me Why .. Splunk Likes Mondays ... View more

I had it working 7.1.1 and yes its free . BTW 7.2.1 breaks it 🙂 ... View more

I have the same issue - hasn't worked - ever 🙂 ... View more

Splunk … When all HEC breaks loose ... View more

I am having the same issue - did you resolve it ? ... View more