We are having the same issue on Splunk Enterprise 9 and DB Connect 3.7.0. Is there another way to workaround this issue without changing the logging settings? Any ETA on a fix for the Splunk DB Connect app? ... View more

Hey David. First of all, thanks for the App. It's very useful. I tried v2.2.0 of the app but realized that we need to edit the json files. For instance, the firewall logs by default is for Palo Alto while we are using a mixture of Cisco and Fortinet. If you next release can incorporate a set up or settings interface, it woud be perfect! ... View more

You actually need to have the "Splunk Add-on for Microsoft Windows" installed on your Searcheads/Indexers. https://splunkbase.splunk.com/app/742/ This will configure all of the necessary field extractions in order to allow those searches to run, and as you have noted formats the data inline with the Splunk Common Information Model When you install the TA on an indexer/SH you don't need to configure anything, simply install and restart when prompted. Sidenote: Best practices says that ideally you remove the inputs.conf/eventgen.conf/sample data when installing to Production, but not strictly necessary. ... View more