I've installed Splunkforwarder 4.3 on a CentOS server, using rpm -i command. I've changed the indexing receiver port using the Splunk CLI ./splunk add forward-server 10.0.0.100:7002 -auth admin:changeme which works and is reflected in /opt/splunk/etc/system/local/outputs.comf I also changed the management port ./splunk set deploy-poll 10.0.0.100:7089 which is reflected in opt/splunk/etc/system/local/deploymentclient.conf [target-broker:deploymentServer] targetUri = 10.0.0.100:7089 However, when I start the splunkforwarder, the splunkd.log contains 02-06-2012 16:51:48.684 +0000 INFO loader - Arguments are: "splunkd" "-p" "8089" "start" "splunkd" ... 02-06-2012 16:51:48.730 +0000 WARN DeploymentClient - Unable to send handshake message to deployment server. Error status is: not_connected Anyone with clues? I can telnet to the deployment server on port 7089, so I know traffic will flow, and the connection to port 7002 is successfully initialized. Any and all help will be appreciated. ... View more

I'm running Splunk 4.2.5 server on CentOS. I've also installed SplunkForwarder 4.3 on a Win2k3 server, collecting Application, Security, and System events. On the server, I have defined props.conf [WinEventLog:Security] TRANSFORMS-set=dropevents transforms.conf [dropevents] REGEX = (?msi)^EventCode=(560|562|567).*^(Type=Audit Success) DEST_KEY = queue FORMAT = nullQueue I've tried various forms of the REGEX, including just the EventCodes, one EventCode, etc. Nothing seems to work; no events are dropped. I read that this was a known issue before 4.2.1, but it is not listed in the 4.3 known issues. Can anyone enlighten me as to what I may be doing wrong? ... View more