Hey Giuseppe, thank you for the documentation on the load balancers, i do have my forwarders set to my manager node which is 10.1.70.27:9997 and from there I believe looking at the documentation will load balance to the other two indexers I have. I do have other indexes created but I'm primarily concerned with just getting the data in the first place and then separate from there seems like the best idea currently to me. Haha there are no stupid questions where I'm concerned, I'm convinced I'm missing something simple. But to answer your question, yes I do have the deployment apps set to restart the forwarder after install. I am receiving internal logs from my forwarders.  ... View more

Hey Gisueppe, I have my UF pointed to 10.1.70.24:9997 which is the correct IP for the first of my indexers in that cluster. I checked for the past week and checked my data summary in the Search App. I have the logs pointed to the main index for now. But no data in any of those three locations. ... View more

Hey PickleRick, my UF is sending _internal logs to my indexers and my effective inputs are all the ones I defined in my inputs.conf file that I deployed with the app. C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf disabled = 0 host = $decideOnStartup index = default C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf interval = 60 C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf sourcetype = MSAD:NT6:DN S C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf [SSL] C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf _rcvbuf = 1572864 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf allowSslRenegotiation = true C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf certLogMaxCacheEntries = 10000 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf certLogRepeatFrequency = 1d C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf cipherSuite = ECDHE-ECDS A-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AE S256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf ecdhCurves = prime256v1, secp384r1, secp521r1 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_resolve_ad_obj = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf host = $decideOnStartup C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf index = default C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf logCertificateData = tru e C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf sslQuietShutdown = false C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf sslVersions = tls1.2 C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf [WinEventLog://Applicati on] C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf checkpointInterval = 5 C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf current_only = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf disabled = 0 C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name = C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_resolve_ad_obj = 0 host = $decideOnStartup index = default C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf interval = 60 C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf renderXml = true C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf start_from = oldest C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf [WinEventLog://DFS Repli cation] ... View more

Hi Giuseppe, For the main search head server, it is actually a holdover from an older SIEM system that I repurposed for Splunk. I did speak with a Splunk Architect about that and said for the deployment size in its current state that it would be fine to host all these roles on that server due to how powerful it is. I can't convert it to a VMWare ESXi host as I would like due to the fact that some of the hardware included is incompatible with ESXi. Each of the indexers has 64 GB of ram and the Search Head has 128 GB of ram.   As for the Syslog-ng server, I utilized it after research purely due to the higher quality of documentation on their website. I don't really have a preference for either outside of it. I do have a Universal Forwarder installed on it and monitoring the destination locations but the Syslog-ng service refuses to start (no error code outside of just stating failure.) journald and systemctl logs doesn't offer any more insights either. I did check the syntax and there's no issue there despite extensive modifications I used "syslog-ng --syntax-only" command which came back clean. I do have Universal Forwarders installed on the domain controllers and file system but the clarification point that you added for "You don't need to create an inputs.conf, you can take the one in the apps to deploy (e.g. the Splunk_TA_Windows) and enable the inputs you want; custom inputs must be used only for custom inputs in custom Add-Ons." Was actually what I was looking for! Could you provide a documentation link to where I can implement a load balancer or would I be looking for a third party software to implement this? ... View more