Hi apcsplunkadmin, I'd be more than happy to have a conversation and point you in the right direction. Please ping me a note at: sobrien@splunk.com Regards, Simon. ... View more

Hi ejmin, The file to modify is indexes.conf, outlined here: https://docs.splunk.com/Documentation/Splunk/latest/admin/indexesconf If you have a naming convention, you can then script the creation of all the required stanzas. I would caution you to consider why you want that many indexes though, it will lead to difficulties in management and maintenance. ... View more

Hi Ron, This app is being deprecated and replaced by the EMC Isilon app for Splunk Enterprise - https://splunkbase.splunk.com/app/2688/. This new app leverages the API of the Isilon to do the user mappings, removing the need for the lookup file in the older app. It is to be used in conjunction with the Isilon TA. You can read more about it here - https://bigdatabeard.com/2016/09/22/auditing-excitement-with-isilon-enabled-by-splunk/ HTH, Simon. ... View more

Are you referring to authentication to the Splunk platform itself, or ingesting data from AD to populate identities in Enterprise Security? ... View more

Hi Mitchell, A good approach for this is to use the pivot interface, which you can access from settings -> data models -> pivot. In this interface, you can specify the filter or search fields you want, to display the output you are looking for. From there, there is an 'open in search' button that would show you the search string that was used to generate the output. This search string will be based on the 'pivot' command. It will look something like: | pivot Network_Traffic All_Traffic count(All_Traffic) AS "Count of All Traffic" SPLITROW action AS action FILTER dest_port = 22 SORT 100 action ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 Another option is to look at the 'datamodel' search command: | datamodel [] [<object>] [] This is documented here: http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/Datamodel HTH. ... View more

I see. Those dashboards require SA-Ldapsearch to populate. Can you confirm if you have that installed and configured? https://splunkbase.splunk.com/app/1151/ ... View more

Thanks for sharing, Miles! ... View more

Within the search app, do you see any data at all related to these sourcetypes? That is, if you go to apps -> search and reporting -> search for "*" , do you see any results? If not, if you change your search to index=* , do you see any data? ... View more

Hi dmarquardt_climate, The best way to achieve this is to run up a centralised syslog server that can be used to aggregate the feeds from your various appliances, and to run a Splunk forwarder on this same device. This will allow you to send data to Splunk Cloud in an encrypted format, and also allow you a greater level of fault tolerance. This is not dissimilar to best practices within Splunk Enterprise, as outlined here: https://wiki.splunk.com/Things_I_wish_I_knew_then Another great article that outlines how to achieve Syslog success with Splunk: http://www.georgestarcher.com/splunk-success-with-syslog/ Hope this helps. ... View more

Hi Jawebb, You'll need to ensure that the owner of the Splunk folder structure is the same user that is used to run Splunk. This could be the system account, or a domain account. This ownership needs to be set, along with the permissions. Once this is done, restart Splunk. Hope this helps. Please let me know if it does, and I'll submit this as an answer. ... View more

Hi Tim, This app is not supported on 6.1 and below, due to the nature of some of the functionality it requires. If you need to have something working on 6.1, please let me know and I will try to make something available. Hope this helps. ... View more

Hi Jacob, A good way to achieve this would be to break up your fleet into smaller serverclasses: https://docs.splunk.com/Splexicon:Serverclass You can then confirm the successful install of your apps and updates per serverclass prior to rolling out to the rest of the fleet. Hope this helps. ... View more

This fix worked for me also. There was a legacy fwopsec.conf entry specifying ssl_opsec as the auth type. Changing this and restarting fixed the error message "Client could not choose an authentication method for service lea" and we now have logs streaming into Splunk. ... View more

Hi Tim, No, Splunk cannot parse your binary log files. You need to either: 1 Export the logs from the management server using the fw logexport command 2. Setup the OPSEC LEA connector - https://splunkbase.splunk.com/app/1454/ The second option is the recommended approach, as this will give you a continued feed of logs into your Splunk platform for analysis. HTH. ... View more