In the cofense addon https://splunkbase.splunk.com/app/5253/ this confused me for a while on what the credentials where tried adding   the username and passwords in the credentials, by which I thought it means the username and password you use to access the gui In the cofense v2API  we can create Client ID: Client Secret: but that doesnt seem to work with app (think its V1) Found eventually under Account mangement that a User can create an API V1 key so use the logui gin as the username and the API as the password It now seems obvious , put posting for thick people like me , who might find this useful ... View more

in the distsearch.conf on our search head we can blacklist applications   [replicationBlacklist] splunk_app1_blacklist = apps/splunk_app1/... splunk_app2_blacklist = apps/splunk_app2/... We can also define groups of search peers (here we have peers in two groups) [distributedSearch:dmc_group_main] servers = 172.21.72.127:8089,172.21.72.128:8089 default = true [distributedSearch:dmc_group_satelite] servers = 10.1.1.1:8089,10.1.1.2:8089 default = true   If we dont have indexes for app1 and app2 on peers dmc_group_satelite, can the [replicationBlacklist] be written in a way  so that its not pushing the peerbundles to it ONLY want  to push bundles to group_main (no need to have a knowledge bundle on peers that dont have searchable index) Many thanks, Jon   ... View more

  Dear Splunkers, Trying to get my apache logs from predefined into key value pairs and supply to the web admins for his modification of the httpd.conf the documentation under the Splunk addon for Apache web server , the xml stanza does not have any closing elements and is breaking the httpd startup (syntax of conf) https://docs.splunk.com/Documentation/AddOns/released/ApacheWebServer/Configure Has anyone installed this app and have a correct <IfModule log_config_module> block that I can pass on Many thanks ... View more

in the current version 3.3.1 of Splunk DB Connect , this bug makes adding new database source impossible without reverting to editor 'Execute SQL' Preview is a requirement for adding inputs in the App (dont seem to be able to by pass it) Any word on possible upgrade to the app to fix? Or have people been successful in reverting back to an older version of the App (and which one ?) Many thanks, Jon ... View more

It seems like we have a fix in 7.3 for the splunk date-time issue since 2019-11-07 Not that long ago we were told to stay away from 7.3 by splunk (7.2.6 is what we are mainly on) But it seems an age for splunk to get a fix out for 7.2 and 6.6 which are surely major deployment versions for splunk users Any chance of an available fix before january ?? Help splunk! ... View more

Hi , Our desktop team are looking for a reference company who has rolled out sysmon under splunkUF Size 5000 endpoints Mix of windows7/10 business has an engineering focus would anyone be interested in a quick meeting and seeing if they have experienced any issues (performance or otherwise). Many thanks if willing to help out a fellow splunker ... View more

Less of a question, but just wanted to say Many thanks for this, works like a treat. I found I had to set UseLegacySyslogFormat=No in the dbparm.ini to send the priority of the SYSLOG to Splunk, and then add this in the props.conf for line breaking for multiline events that are sent from the vault. [cyberark:epv:cef] LINE_BREAKER = (<5>1 ) There may have been a better way (I'm a bit of Splunk newbie), but thanks for this TA which is most useful. ... View more