Hello to all. I am using the CEF Extraction TA for extracting CEF fields in a FireEye log.  When I test this on a standalone system with Indexer and Search Head, the cs#Label fields extract correctly. As soon as I put this in an environment with a Heavy Forwarder, Indexer, and Search Head distributed (or even just Indexer and Search Head)., the fields will not extract.   I am at my wit's end here. Help?  Thanks! ... View more

We created an app just for us admins in Splunk. All of the dashboards and the searches populating the dashboards are shared within the app. We added an additional role to the access of an app. A user in this newly-added role opened a dashboard and saw that the panels of the dashboard were not loading. For some reason, ONE panel was visible and was given proper access, however, none of the other panels are visible because the searches driving the panels aren’t given permissions to the new role within the app. Shouldn’t the new role, when granted to the app, inherit all of the permissions and access to all of the objects shared within the app? I can’t imagine this is by design. If this is the case, we would have to touch each artifact within the app and grant permissions to the newly added role. Please help! Thanks! ... View more

I turned on monitoring of /var/log, and when it gets to /var/log/yum.log, I am getting 3 different yum source types for my different systems. All systems are the same Linux flavor. yum yum-2 yum-too_small This is messing with my field extractions. What is causing this behavior? Thanks. ... View more

I am seeing many references about how the "syslog" sourcetype takes the hostname form the /var/log/messages logs, by design. However, we want FQDN. I am also pushing the Linux T/A via Deployment Server, so I cannot easily override etc/system/default/transforms.conf. How do I get FQDN for ALL of my linux /var/log logs? Thanks. ... View more