This Worked for me as well.  No need to give admin_all_objects permission! Splunk V. 8.2.5 ... View more

Splunk Add-on for F5 BIG-IP (built and officially supported by Splunk) Pros: Pulls data from F5, you have option to filter and specify what data you are interested in. Cons: You can only ingest the data into Splunk using this App, Visualizations you have to create your own.. Require credentials with apropriate role to query F5 for the data, and password management is bit challenge when more F5s and no integrated authentication. F5 Networks - Analytics (built and officially supported by F5) Pros: Require no authentication, depends on F5 iApp to push the data to Splunk indexers Comes with pre-built Data Models & Dashboards Cons: Visualization are very slow and doesn't appear to me scaleable to larger audience What I ended up doing is using F5 Networks - Analytics (built and officially supported by F5) App for data models (F5 iApp push data to Splunk indexers) and build my own visualization. https://answers.splunk.com/answers/618950/use-of-f5-network-analytics-app-for-customers.html#answer-619283 ... View more

Add host_segment into your monitor input stanza(s). For example: [monitor:///var/log/remote/year/month/day/server_name/messages] host_segment = 7 index = your_index sourcetype = your_messages_sourcetype disabled = 0 [monitor:///var/log/remote/year/month/day/server_name/secure] host_segment = 7 index = your_index sourcetype = your_secure_sourcetype disabled = 0 It will use server_name (7th segment) from /var/log/remote/year/month/day/server_name/messages as a host name value. ... View more

You are welcome. To be fair, It's a couple of links down the chain... ... View more

You can override the Host override in transforms.conf to force a domain suffix Beware: You may need to adjust the REGEX to remove any existing domain suffix prior to forcing one on this way. local/transforms.conf [nmon_data_hostoverride] FORMAT = host::$1.yourdomain.com ... View more

Thank you @jschwanz, this is exactly what has fixed my problem as well. ... View more

You saved me a ton of troubleshooting hours by posting this. Thank you for taking the time to do it. ... View more

I think you have it pretty much the only/best way right now but I definitely like your idea of Splunk adding a dispatchQueue that removes from all further processing and dumps directly into indexQueue . You should definitely request this feature. ... View more

You can view the public key and installation instructions at the PGP Public Key documentation page http://docs.splunk.com/Documentation/Splunk/latest/Installation/PGPPublicKey you can download the public key using curl -O https://docs.splunk.com/images/6/6b/SplunkPGPKey.pub ... View more

Splunk 6.0.3 has been released, which that patches Heartbleed and a separate TLS vulnerability ... View more