yannk mentions the SOS app - this has been deprecated - if you have version 6.3 or above this has been replaced by the DMC. We too are getting this error message - any thoughts on a solution for this issue? Audit event generator: Now skipping indexing of internal audit events, because the downstream queue is not accepting data. Will keep dropping events until data flow resumes. Review system health: ensure downstream indexing and/or forwarding are operating correctly. ... View more

I have the same issue: Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group cprobe has been blocked for 10 seconds. This will probably stall the data flow towards indexing and other network outputs. Any suggestions? ... View more

You can refer to this article: https://medium.com/@grizzbaier/making-the-splunk-app-for-aws-work-in-the-govcloud-region-7587bedcfc83 ... View more

Hello deepashri: More background: Multiple forwarders only one indexer. So I would like to know how to create an alert/s that grabs the following (from ALL servers) - #1. Log failure/processing; #2. audit logs; #3. exceeds maximum audit record storage capacity (triggers at 75% capacity); #4 audit failures; #5 Admin logons and changes. ... View more

The environment is mixed: Windows and Linux. We're planning to use a scripts however I was just asking if Splunk has built-in dashboards or add-ons where I could use out-of-the-box? On my research, for Change Management, Splunk has dashboards with over 40 reports built-in to it. What I'm trying to understand is if Splunk has this "out-of-the-box" capability to monitor unauthorized software installs. Would there be something written in the Splunk docs - so far have not found what I'm looking for. ... View more