Yep, that's the default self-signed cert that comes with Splunk like I suspected.  There's likely no way to fix that on a Cloud trial (and you'll have to disable SSL validation for testing) but you won't have to do that on a production Splunk Cloud stack.  ... View more

Can you post the output of this command? (replace with your trial stack's name).  openssl s_client -connect prd-p-xxxxx.splunkcloud.com:8088  I suspect the cert you'll see returned is from the Splunk internal CA, and that the Splunk Cloud trials are not set up with a signed cert on port 8089. On a production/paid Splunk Cloud stack you'd send logs to https://http-inputs-<stack_name> .splunkcloud.com on port 443 and I've never seen an issue with certificate validation in those environments (it uses the same cert as the web interface).  ... View more

Recent versions of the Splunk Universal Forwarder install with a least privileged user that doesn't have the ability to pull Windows event logs by default.  This is different from older versions of the UF which worked differently and could pull all logs by default.   I'm not familiar with what you can do with Intune, but do you have the ability to specify command line arguments to run with the deployment? I'm thinking you may need to add something like WINEVENTLOG_SEC_ENABLE=1 (or similar).  See https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller#Supported_command_line_flags for details along with other supported options.  ... View more

Divya9326, What happens when you run the script to pull the logs manually? Do you get any output or error messages? ... View more

No, multiple heavy forwarders connecting to the same management server would result in duplicated events. If you have multiple management servers, you could distribute that across multiple heavy forwarders, but you'd only want to collect each type of data from each management server once. ... View more

Is this a standalone or distributed Check Point environment? (eg, is there a dedicated management server, or does the management server and the firewall exist on the same server/appliance) Do you have an explicit firewall rule to allow the Splunk forwarder to communicate to your management server on the FW1_lea service? If you were able to pull the certificate successfully that would confirm that FW1_ica_pull is allowed at least. If you make any modifications to these rules you'll need to either install database to the management server, install policy to the firewall, or both (depending on the communication path and type of Check Point environment). ... View more

This new app should work fine on a Windows Splunk environment, since there isn't a OS dependent mechanism to collect the data like there was using OPSEC LEA. ... View more

I've created a number of Splunk tutorials and videos that you might find useful: Installing Splunk on a Linux VM Splunk Infrastructure Design and Sizing Splunk Storage Sizing Separately, I've also put together a training class that will get you started with some common Splunk administration work, including building a Splunk instance, onboarding data, using apps on the common information model, and doing some basic searching and reporting work. It's not a replacement for the Splunk classes, but should provide you with enough experience to get started with using and administering Splunk. Let me know if you have any questions. Good luck with learning Splunk! ... View more

There is an app that supports using Check Point log exporter (sk122323, sending logs via syslog): https://splunkbase.splunk.com/app/4180 This should allow you to collect logs via syslog and have them normalized to the CIM. ... View more

It isn't recommended to increase the default maxresultrows in the [searchresults] stanza of limits.conf per the documentation: This limit should not exceed 50000. Setting this limit higher than 50000 causes instability. Reference: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf It's possible that another configuration could be in play here, can you post the search you are running? ... View more

Something to keep in mind when doing this sort of migration - just copying the user data will likely not be sufficient for everything to work properly. You will also need to ensure that any knowledge objects used by existing reports (field extractions, lookups, etc) are migrated as well. If this is a case where you are replacing your search head with a new one, it would make the most sense to perform a migration of the configuration to ensure everything is moved over. ... View more

I have had success using a configuration like this for handling json: [sourcetype] DATETIME_CONFIG = INDEXED_EXTRACTIONS = json KV_MODE = json NO_BINARY_CHECK = true category = Structured disabled = false TRUNCATE = 999999 Once this data is indexed you can use the mvexpand command to view all values for the testid field. ... View more

If you are looking to locate systems that have stopped sending data to Splunk, you might want to look at the Broken Hosts app, https://splunkbase.splunk.com/app/3247/. Having a lookup table containing host information already puts you in a good position to configure this app, since it uses a similar concept for tracking hosts and how frequently they should be sending data. ... View more

Assuming this is a distributed environment, I've seen this issue occur when internal logs from the license master are not making it to the indexing tier. For whatever reason this resulted in the license usage never resetting and adding each day, like you're describing here. This issue was resolved by adding an outputs.conf to forward the logs from the license master to the indexers (and restarting Splunk on the license master). If you're not able to search for logs from your license master from your search head this might be the case in your environment that's causing the issue. index=_internal host=license_master_name ... View more