For SQS S3 and Cloudtrail just clone your input and create multiple inputs.  Just watch resources (CPU, Load Average) on the host where the inputs are defined.  If you modify any python code then the TA will no longer be supported and will break with upgrades. ... View more

You are seeing that the app is supposed to be compatible.  It is not a Splunk Supported addon. ... View more

We are investigating the UI issues with the App/Addon in Splunk light. All inputs are now configured using the addon and not the app. You can access the specific pages using: You can access those at: https://cloudinstance.cloud.splunk.com/en-US/app/Splunk_TA_aws/inputs For account configuration... https://cloudinstance.cloud.splunk.com/en-US/app/Splunk_TA_aws/configuration ... View more

You could setup two instances of the splunk forwarder on the same box. One sends to prod, one sends to dev. If you want all the logs to go to both you could also setup index and forward on the indexers and forward the data. ... View more

email settings are the default settings. It seems to have stopped working on Monday (looking at the error counts). Not sure why it stopped working all of a sudden. ... View more

I was kind of hoping to avoid that option but looks like I won't have a choice. Are the settings part of local.meta? Currently authentication, authorize, and other .confs are deployed to SHC members via an app. Thanks, ... View more

6.2.2 is available. It is also fixed there. ... View more

Ok. But in the docs it states: "Caution: This command causes an overwrite of the member's entire set of search-related configurations, resulting in the loss of any local changes." What does "loss of local changes" mean with this? Any changes that have been made are lost? For all time? For the last hour? ... View more

Are you running Splunk 6.2.x? The file doesn't exist in 5.0.x. ... View more

This is a problem we have seen with 6.2.1 (or 6.2). We didn't see this problem in 5.0.x. ... View more

Outputs.conf would point to your indexers from the HF. outputs.conf would point to the HF from your UF's. We have out HF's listening on different ports for data. So inputs.conf would contain something like: [tcp://9997] sourcetype=http [tcp://9192] sourcetype=os We also put any props and transforms on the HF's. We actually have separate props apps but one would do fine. We just have a lot of data feeds. You might also look at: http://answers.splunk.com/answers/169929/using-heavy-forwarders-as-an-intermediary-layer.html ... View more

We do something similar to what you are referring to. Yes, outputs.conf on the searchhead to forward data to the indexer. We have an indexapp that contains a local directory with indexes.conf in it. Whenever we add an index we update that file and deploy to all of our indexers and any searchhead who need the index list. We use a script to "enable" the indexes without restarting the indexers. echo Enter in Admin password read pw for indexer in indexer1 indexer2 indexer3 do echo $indexer echo ------------- curl -k -u admin:$pw https://$indexer:8089/servicesNS/admin/indexerbase/configs/conf-indexes/_reload curl -k -u admin:$pw https://$indexer:8089/services/data/indexes/_reload echo sleep 1 done echo ------------- echo Indexes reloaded ... View more

Yes deployer is 8088. Reset passwords and am still seeing the same issues. ... View more

Unofficial fix. Make a copy of any file before you change it. We found that if you modify: $SPLUNK_HOME/share/splunk/search_mrsparkle/templates/pages/static.html After the head tag add: <meta http-equiv="X-UA-Compatible" content="IE=edge" /> then around line 79 change the line to (comment out the line): // document.write('<meta http-equiv="X-UA-Compatible" content="IE=edge" />'); You don't have to change the setting. ... View more