Dears Thanks A lot for helping Already. i have 2 heavy forwarders(HF) and one Indexer(AIO) Im facing this issue for the first time,(HF-1) is not forwarding logs to AIO , though HF-2 is sending normally to the AIO and i can search the logs . The thing is i tried telnet on both sides it did connect, it seems there is no network problem, firewall is down, SElinux is down below are some logs on the HF-1 03-14-2020 02:00:54.097 +0300 WARN TcpOutputProc - The TCP output processor has paused the data flow. Forwarding to output group primary_indexers has been blocked for 230 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data. 03-14-2020 01:23:22.056 +0300 WARN TcpOutputProc - Read operation timed out expecting ACK from 10.244.2.100:9997 in 300 seconds. ... View more

Dears Is there any any add-on or steps to onboard (collect and parse) logs from Symantec mail security Appliance not cloud. which is sending logs using syslog to Splunk Collecter (HF) Thanks for your kind help. ... View more

Dears Im using ITSI version 4.0 , i followed the documentation for the installation but yet the default modules that comes with ITSI like OS, webserver etc .., is not working probably, when ever i want to do auto discovery for entities using module search like OS one, it give me an error savedsearch is not found tho it is enabled and i can search for it in the ITSI-search, so i start copying conflagration from the Modules to the ITOA/local/ and it worked .. is this normal case or not?? can anyone advice me! Thanks already ... View more