Hi all, I have a situation where there are servers from which we wish to get logs into Splunk. However, we cannot use the traditional Universal Forwarder because these servers are not allowed to connect through the firewall to the indexer. We can go from "inside" the firewalled network to these servers "outside" the network. So we could perform some sort of API calls if necessary. Is there a way to set up a Heavy Forwarder to poll the servers "outside" the network and pull in the logs? Does the UF support being a "server" instead of a "client", meaning UF would expose an API that could be queried by an HF? Any and all suggestions (aside from reconfiguring firewall) are welcome, thanks! ... View more

Hi all, I'm dealing with a legacy Splunk installation where I'd like to clean up an index for consistency. Lets say I have an index called 'mydata'.  This index is active and has events indexed there fairly regularly (i.e. many times a minute) Previously, this index was defined manually in /opt/splunk/etc/system/local/indexes.conf. The home path was specified as /opt/splunk/var/lib/splunk/mydatadb/db'.  (NOTE: the folder 'mydatadb' in the path) Most of our other indexes use the notation of having the home path folder the same name as the index.  I would like to migrate this existing index to use this pattern. Can I simply update indexes.conf to use '/opt/splunk/var/lib/splunk/mydata/db' then manually rename the folder in the filesystem, and restart the indexer? Is there any metadata or anything else in the db that would cause this path change to break the indexed data?   ... View more

I need to add to the PATH environment variable used by Splunk Universal Forwarder. I have tried editing splunk-launch.conf and I have checked the envvars using splunk envvars but this doesn't seem to set the path. Is it possible to set the PATH variable that Splunk uses? (Note, I only want to setup this specialized PATH for the splunkd instance. I do not want it to be systemwide) ... View more

Is it possible to ingest information from multiple ServiceNow instances using a single "Splunk Add-on for ServiceNow"? We have multiple ServiceNow instances, and a single Splunk infrastructure we would like to ingest into. My current strategy is multiple "apps" in Splunk, one for each ServiceNow instance. Can I configure a single apps/Splunk_TA_snow to ingest from multiple ServiceNow urls? ... View more

I'm using Splunk_TA_windows addon as a deployment app. In the local/inputs.conf, I've added a stanza to monitor Windows Event Log where the channel does not exist on all the Windows computers where the Splunk_TA_windows app is deployed. This is causing errors in the splunkd.log. It is possible to configure the inputs.conf for specific computers, or suppress error logging on inputs which are known not to exist on all computers? Is the only answer to make another deployment app for the specific servers? ... View more

I am trying to make some reports for apps and deployment apps. I was able to use: | rest /services/apps/local to get the label, version, author and description of local apps. How do I do I get this same information for the deployment-apps? I've tried | rest /services/deployment/server/applications but it does not show the label, version, author or description? ... View more