Hello, I know that forwarders have the path /opt/splunk/etc/system/local where you can find files like inputs.conf, outputs.conf, props.conf... and when you create an input application (for example to read logs from a path) you have the path /app_folder/local where you can find files with the same name (inputs.conf, outputs.conf...) Which is the difference between the files of each path? In the case that you have different universal forwarders, and forward data to Heavy Forwarder to filter and finally send to indexers, how can I configure a heavy forwarders to define which app is going to work with the data from any source? Thanks ... View more

Hello, I have two companies that use the same Active Directory but each one has a different Splunk platform (both in cluster mode). Now, I have installed a universal forwarder (UF) on each domain controller, and I want to forward events to both Splunks following these conditions: Get just events with a specifics EventCode Forward to the Splunk of the first company information about all domain Forward to the Splunk of the second company information just about the second company OU The configuration that I have (I don't know if it's OK) inputs.conf [WinEventLog://Security] disabled = false index = active_directory start_from = newest whitelist1 = 4720,4722,4723,4724..... (eventCodes) whitelist2 = .*OU=secondCompany,DC=local,DC=domainName$ I don't know how to apply whitelist2 just to company2 forwarding outputs.conf [tcpout] defaultGroup:company1,company2 [tcpout:company1] server = company1indexer1.local:9997 server = company1indexer2.local:9997 [tcpout:company2] server = company2indexer1.local:9997 server = company2indexer2.local:9997 If I'm in the right, I have to deploy the application to UF (DCs) just from the deployer server of the Splunk of the first company, but forward data to the forwarders of both Splunks (data cloning) — is that right? Is it a problem that indexers of each Splunk uses different pass4SymmKey? Is it a problem that each Splunk has a different index name for active directory logs? A lot of thanks. ... View more

After check some different questions about this I cannot find a solution. I'm trying to point my search head cluster to my indexers cluster using Cluster Master but when I use the following command on a SH Cluster member: /opt/splunk/bin/splunk edit cluster-config -mode searchhead -master_uri https://cmserver:8089 -secret myKey I recieve the following error message: Could not contact master. Check that the master is up, the master_uri=https://cmserver:8089 and secret are specified correctly splunkd.log on cluster master: 01-21-2019 18:25:15.530 +0100 ERROR DigestProcessor - Failed signature match 01-21-2019 18:25:15.531 +0100 ERROR LMHttpUtil - Failed to verify HMAC signature, uri: /services/cluster/master/info I think that pass4SymmKey is equal on both servers, but how can I check it? Thanks ... View more

Hello, I'm deploying a search head cluster and I have a doubt about the steps described on the following link: https://docs.splunk.com/Documentation/Splunk/7.2.1/DistSearch/SHCdeploymentoverview I understand that server.conf file is the file that you can find on /opt/splunk/etc/system/default folder, it's ok? On this file I can see too the configuration line "disabled=true" but documentation don't specify as necesary modify this flag, it's ok or should I change to false? Thanks ... View more

Hello, I would like to know if exists any way to integrate the new Rapid7 vulnerability managment tool InsightVM with Splunk. We are working on a clustered environement. Thanks ... View more