How to integrate Symantec Control Compliance Suite with Splunk ? Has anyone done this before and how. ... View more

I see some searches apparently are running but since the user activity is less these days so cant confirm if those events are happening which violates the many of the OOB correlations rule. Other the other hand, log ingestion is no less. how to ensure that splunk correlation rules are running continuously in background and there is no issue from the searches side. ... View more

I want to understand the irregular behaviour of output displays for "notable events over time" panel in ES. Right now its 4th july and its still showing data only till 3rd july. Whats wrong here.. What i have observed in past this panel does not keep up with time and shows data till some hours ago only. The search SPL running this panel constituents a collection "es_notable_events" which is in KV store. When i access this by - | inputlookup append=t es_notable_events , i see same old events which lags behind for some hours. Now basically the issue is - this KV store lookup is not getting updated time to time causing the panel not to update and keep pace with time. I want to understand why is this es_notable_events not getting updated and how does ES updates this ? ... View more

The Splunk Add-on for Microsoft Exchange is not fetching the logs from 2016 exchange server. I have tried updating the inputs, props and transforms (in local) by replacing keyword '2013' to '2016' as its says in the defaults that its compatible with both 2013/2016. We are using TA-Exchange-ClientAccess and TA-Exchange-Mailbox. Its still not collect logs from 2016 exchange servers. How can we collect logs? ... View more

Splunk MC while setting up in distributed mode has error : " At least one of your instances is a deployment server plus other non-deployer roles. We recommend only deployer roles per deployment server. " I have edited the role and kept - DS, KV store and LM together. Basically in my infra, i have DS, LM and MC all on one box. Why this warning is coming, i am not able to understand what this want to say and What shall i do to not get this warning? ... View more

Our requirement is that there is no cold data. Once the data comes in it will be keep warm for 90 days and then it will be moved to frozen directory. We have done sizing and we have 3.2TB for warm volume and 3.8TB for frozen volume for all indexes. indexing is 60GB/day. here is my stanza : [firewall] homePath = volume:primary/firewall/db maxHotBuckets = 3 maxTotalDataSizeMB = 204800 enableDataIntegrityControl = 0 enableTsidxReduction = 0 maxWarmDBCount = 300 coldPath = volume:primary/firewall/colddb frozenTimePeriodInSecs = 7776000 coldToFrozenDir = "/splunk_frozen/frozen_logs/firewall" thawedPath = $SPLUNK_DB/firewall/thaweddb do i still need to define coldDB address ? my coldToFrozenDir is giving error where as the directory exists with 'wr' permissions. what is the best approach to achieve this. ... View more