I have been trying to load balance firewall logs across a 12 node index cluster the heavy forwarder is under cluster control . It sees all 12 indexes to be able to write to from its "plunk list forward-server". But regardless of all the changes I have been making in the outputs.conf with LB settings it never want to send to more than five when I monitor | tstats summariesonly=t count WHERE index="network_traffic" by splunk_server _time | timechart span=1m sum(count) by splunk_server autoLBVolume=1048576 autoLBFrequency=5 I have split the ingest into multiple small files using syslog-ng Im just wondering is this "five" a hard limit for a forwarder? or a limitation for the old release I am currently on (will I have to create a horizontal forwarding layer for the firewall logs , artificially splitting the syslog ) Im running Splunk Enterprise 7.3.9 Many thanks , if anyone has any insight ... View more

Hi , does anyone have any experience with Parsing Version 6 schema of Umbrella logs the release notes from the addon https://splunkbase.splunk.com/app/3926/ talks only of version5 1.0.5: Adds support for logging format version 5 + Firewall Logs   the change in Umbrella seems for my environment to be only from Version4 -> version6 and "Schema upgrades are one way; you will not be able to revert this upgrade." Its scary you cant revert   Anyone moved to version6 and did they make changes in the local/{props,transforms} ?   ... View more

Splunkbase page for the app https://splunkbase.splunk.com/app/833/ says its supported for 7.3 But the Release notes says its only supported for 8.X https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/Releasenotes 8.3.0 package  is no longer on splunkbase Can someone let me know if 8.3.1 is supported on Splunk enterprise 7.3.X Many thanks, Jon ... View more

In the cofense addon https://splunkbase.splunk.com/app/5253/ this confused me for a while on what the credentials where tried adding   the username and passwords in the credentials, by which I thought it means the username and password you use to access the gui In the cofense v2API  we can create Client ID: Client Secret: but that doesnt seem to work with app (think its V1) Found eventually under Account mangement that a User can create an API V1 key so use the logui gin as the username and the API as the password It now seems obvious , put posting for thick people like me , who might find this useful ... View more

in the distsearch.conf on our search head we can blacklist applications   [replicationBlacklist] splunk_app1_blacklist = apps/splunk_app1/... splunk_app2_blacklist = apps/splunk_app2/... We can also define groups of search peers (here we have peers in two groups) [distributedSearch:dmc_group_main] servers = 172.21.72.127:8089,172.21.72.128:8089 default = true [distributedSearch:dmc_group_satelite] servers = 10.1.1.1:8089,10.1.1.2:8089 default = true   If we dont have indexes for app1 and app2 on peers dmc_group_satelite, can the [replicationBlacklist] be written in a way  so that its not pushing the peerbundles to it ONLY want  to push bundles to group_main (no need to have a knowledge bundle on peers that dont have searchable index) Many thanks, Jon   ... View more

  Dear Splunkers, Trying to get my apache logs from predefined into key value pairs and supply to the web admins for his modification of the httpd.conf the documentation under the Splunk addon for Apache web server , the xml stanza does not have any closing elements and is breaking the httpd startup (syntax of conf) https://docs.splunk.com/Documentation/AddOns/released/ApacheWebServer/Configure Has anyone installed this app and have a correct <IfModule log_config_module> block that I can pass on Many thanks ... View more

in the current version 3.3.1 of Splunk DB Connect , this bug makes adding new database source impossible without reverting to editor 'Execute SQL' Preview is a requirement for adding inputs in the App (dont seem to be able to by pass it) Any word on possible upgrade to the app to fix? Or have people been successful in reverting back to an older version of the App (and which one ?) Many thanks, Jon ... View more

It seems like we have a fix in 7.3 for the splunk date-time issue since 2019-11-07 Not that long ago we were told to stay away from 7.3 by splunk (7.2.6 is what we are mainly on) But it seems an age for splunk to get a fix out for 7.2 and 6.6 which are surely major deployment versions for splunk users Any chance of an available fix before january ?? Help splunk! ... View more

Hi , Our desktop team are looking for a reference company who has rolled out sysmon under splunkUF Size 5000 endpoints Mix of windows7/10 business has an engineering focus would anyone be interested in a quick meeting and seeing if they have experienced any issues (performance or otherwise). Many thanks if willing to help out a fellow splunker ... View more

Less of a question, but just wanted to say Many thanks for this, works like a treat. I found I had to set UseLegacySyslogFormat=No in the dbparm.ini to send the priority of the SYSLOG to Splunk, and then add this in the props.conf for line breaking for multiline events that are sent from the vault. [cyberark:epv:cef] LINE_BREAKER = (<5>1 ) There may have been a better way (I'm a bit of Splunk newbie), but thanks for this TA which is most useful. ... View more