@bpenny did you ever figure this out? I'm running into the exact same issue. I think the problem is that we're referencing a json path. If I move the timestamp to a top level json field in the event, it picks up the timestamp just fine. ... View more

I open a ticket with VT.  Looks like current version have a bug that prevent the add-on to save configuration properly.  New version (1.6.1) will be release in the next days.  ... View more

I had the same error, I fixed it by giving splunk user read access to the  logs and the directory they reside in. ... View more

Hi @nbowman, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

You can keep the 6.4 UF's for some more time. Or, as I remember on some other posts here, maybe, UF 6.5 will get installed on Windows 7. The only issue is, the official support from splunk won't be available. ... View more

Thank for letting us know this worked for you! ... View more

Those are two entirely different stanzas so they do not impact each other. Adding a new stanza to etc/system/local will only modify pre-existing stanzas if the stanzas are the same. For example if you added a stanza like [WinEventLog://Security] disabled = 1 to etc/system/local this would override your deployment client's inputs.conf and effectively disable the collection on that box. ... View more

I think you could write and deploy a simple scripted input to just run "ipconfig /all" and index the results. May take some scripting to get it into a nicer format, but I honestly don't think this capability already exists in the Windows TA. ... View more

Yes, that is an accurate summary. Also, I have looked at Splunk's routing and filtering of data that you linked. It doesn't solve my problem because very often in my environment, sysadmins will install a Splunk Universal Forwarder on their systems but won't allow me access to them for purposes of configuration. So, I can't control hostnames. All I can do is point them to my deployment server. Filtering on sourcetype doesn't work either, because the sourcetypes will be the same. ... View more

FYI, Fire Brigade version 2 will no longer be updated (latest version is 2.0.3). The newer versions 2.0.4 and higher will now be available with the original “Fire Brigade” app on Splunkbase which was just updated to support Splunk 6.3. This is noted on the page for Fire Brigade on Splunkbase: https://splunkbase.splunk.com/app/1581/ If you have any questions, ping the developer of the app @sowings Cheers! ... View more