So there is no way to monitor the splunkd.log on the UF from the Splunk Indexer? ... View more

Would this be logged into the metrics log on the UF? I could monitor for no logs, I have done that in the past.  ... View more

I am sorry this didn't work for me and I tried to get it to work. But I already have a solution. ... View more

Thank you for explaining this. I didn't know about this syntax. ... View more

What does the "1d@d" for span mean? ... View more

splunk is running as the splunk user ... View more

Thank you I checked the splunkd.log and found out it doesn't have permissions but I already knew that.  I am just trying to understand why? This doesn't make sense. Splunk user is part of ADM group, ADM group is applied to the file while can't splunk user read the file. What am I missing here?    Insufficient permissions to read file='/var/log/test-combo.log' (hint: Permission denied , UID: 1001, GID: 1001). ... View more

I did leave splunk to manage the operative side. But there was an app pushed form my server to another client that had 700. I am asking what the permissions need to be exactly.  ... View more

Splunkd.pid did not exist in the directory  /opt/splunkforwarder/var/run/splunk/ I got this when I ran the command ps -eaf |grep splunkd splunk 18031 17753 0 12:29 pts/4 00:00:00 grep splunkd   ... View more

That is not the case, I tried with my username and then I tried with the owner username. ... View more

Thank you! from now on I am going to use this! It was so easy to see for some reason there was a inputs.conf in SplunkUniversalforwarder/etc/app/splunkuniversalforwarder/local/inputs.conf     I used the command splunk btool inputs list --debug ... View more

Thank you for this. I was able to do this on the Universal forwarder though.  If I drop it on the UF does it dropt hem to null queue as well?  ... View more

Yeah I was confusing powershell logging with cmd. They are both turned on through the GPO but it seems like I need to go into inputs.conf for powershell logging and make a stanza. ... View more

@to4kawa  Do I need to make a a stanza for each field I am extracting? ... View more

@gcusello   1. yes, the log comes in json format. 2. I do not know what you mean by network input. This is what I have done  Data Input > Files and Directory > /var/log/vpn.log  > continuous monitoring. This means I can search the data in my index.  3.  When I went to search the data there was no extraction done on the data so I couldn't search those fields. Only fields I can search are the host, source, index, and sourcetype which are added by splunk I would assume. So I pretty much I have a raw json log with no extractions. 4. Delimiters does NOT work because it extracts the field like this into my "interesting fields"  when using a comma session.saml.last.attr.friendlyName.eduPersonAffiliation":"| student | member | staff | employee | alum |" This is not helpful at all because it is putting the field name and the data together as a field extracted .  If I decided to change the delimiter to the colon it will then put the assigned data of the previous field name with an upcoming field name together. If I use quotation marks as the delimiter it creates 53 fields some of which are not needed because it creates a colon as a field and I cannot remove them. 5. All of the fields are always populate the problem that I am experiencing is when I use the regex method which I thought would be better because I can choose what fields to extract. If I want to extract the field name "session.user.ipgeolocation.continent​":"NA"   and rename it to "continent" well it only works on two of the logs  even though it exists in all of the logs. I want all of my fields extracted to work on all of the logs not just the two logs.  ... View more