Can someone please respond to my query? ... View more

Here <source>means have you typed exact path of the file or just <source> as is? ... View more

Thank you for the response!! ... View more

Thank you for the information.  So, if the upgraded version is in compatible with the Cribl workers then can we go for upgrade even though the final downstream cloud components runs with lower version? ... View more

yes, we are not receiving logs in _internal index. And here we are collecting logs from Windows servers and forwarding to Splunk console via Cribl workers. And at source end we have validated the connections towards Cribl workers and its working. But still we are not receiving logs at Cribl end. As connectivity is unidirectional from Windows servers towards Cribl workers, we validated it and its fine.  We will validate the connectivity from Cribl workers towards Windows servers as well. If its not connecting, then its because of connectivity issue? if yes, what would be our next action on this?   But we found the error below in splunkd.log file. Can you confirm is it something related to permission issue which is restricting the Splunk UF to collect security logs from Windows servers? if yes, could you please suggest if we proceed with reinstallation with admin privilege would sort this issue? ERROR: ExeProcessor:  message from "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" -  WinEventCommonChannel- Did not bind to the closest domain controller, a further domain controller has been bound. ... View more

Yes, we enabled the forwarding in UF installation and phoning home towards DS is happening and apps are pushed to UF successfully. And we tested connectivity and its successful. Still we are not able to see the logs in Splunk console. We are not sure whether there could be any issue at firewall or network level.  Can you assist us here? ... View more

Hi,   I'm also facing the similar issue. We have installed 9.0.2 version of Splunk UF on windows servers and connectivity towards DS all looks good. And firewall team and NSG also confirmed rules and routing are in place. Still, we are not able to see logs at Splunk console. We are getting error stating "existing connection forcibley closed by remote host" and "TCPout processor stopped to process the flow and blocked for seconds". Can you help us here with your inputs. ... View more

Thank you @shnmugam  Will try the same ... View more

Can someone help me to understand my above query please? ... View more

Can someone please provide the steps to replace expired SSL certificate with renewed one in Splunk UF's version 8.2.8 ... View more

Hi @dural_yyz ,   Thank you for the suggestion. But in our current setup, there is no option to switch to HTTP destination configuration as we are in process of migration phase and these are about to decommission soon.  But, since we received vulnerability report on these UF's on those servers, we are in process of replacing SSL certificate. So, if could able to provide detailed steps on how to upload renewed certificate in universal forwarder which would be really help get rid of this issue ... View more

Hi,   CAn someone please  look into my above listed query and share your response ASAP ... View more

Thank you @isoutamo  ... View more

Hi, @rjthibod will this work in Splunk version 7.6.0, because I have tried it but it still displays $label$ instead of value. Below is my query where I want to fetch TraWeek and should get used as under label in single value chart. Please help me to achieve this. <row> <panel> <title>Transaction points processed</title> <single> <search> <query>index=* sourcetype=member.csv |dedup TraWeek | eventstats max(TraWeek) as Max_TransWeek|where TraWeek=Max_TransWeek|eval PAM1=round(PointsAmountInMillion,2)|timechart latest(PAM1) as TransactionPoints by TraWeek</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> <refresh>30s</refresh> <refreshType>delay</refreshType> <done> <condition match=" 'job.resultCount' > 0"> <set token="title">$result.TraWeek$</set> <set token="label">$result.TraWeek$</set> </condition> <condition> <set token="title">"No Data"</set> <set token="label">"No Data"</set> </condition> </done> </search> <option name="drilldown">all</option> <option name="numberPrecision">0.00</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="underLabel">$label$</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">large</option> <option name="unit">M</option> <option name="underLabel">$label$</option> </single> </panel> ... View more

your search | streamstats count as serial | stats values(*) as * by serial | fields - serial Could you please explain how this command helps to hid columns which has null values in Splunk.  ... View more