In the default/props.conf under [pan:threat] EVAL-url_length = if len(user_agent) This expression is malformed What should it be as I would like to create a local/props.conf until a new addon is released? ... View more

In our Splunk Enterprise environment we log our Cisco IOS events to a dedicated Syslog server. The architecture is the Syslog server is just a universal forwarder that performs input processing. Events are then sent to dedicated heavy forwarders for the domain which perform the parsing process. The heavy forwarders then send off the events to the Indexers. Deployment of 99.9% of the add-ons we have downloaded from Splunkbase get installed to the heavy forwarder and the search heads. My question is why the install instruction for TA-Cisco_ios say install on the Indexer and don't install on forwarders? For this TA which confs / parameters in the conf indicate this TA needs to be installed on an indexer? Is it because people are just sending stuff directly from a universal forwarder to an indexer without a HF in between? I have gone through the TA thoroughly and am still struggle to find any setting that in the TA that performs any index time things I am happy to be corrected as we all come in here to learn. Current environment is Splunk 6.6 but would have posted same question when on 6.3 if time had permitted ... View more