I just stood up a brand new multi-site cluster on Splunk 7.2.4 and while I was pushing out the very first of my configurations I validated the bundle just to see if there were any new features and I noticed that the validation said that a restart was not needed, which I knew to be untrue because I was pushing out my volume definitions. Sure enough, when I pushed it the cluster did a rolling restart. Why would the validation process incorrectly flag a bundle as not needing a restart? This could have been a mess if it had been a live environment and I want to make sure I know how to account for it in the future. ... View more

Hi all, I have created an adaptive response collects information from a host and indexes it. I have attached this adaptive response to a correlation search. I would now like to have the collected information be available in the "Additional Fields" portion of the Incident Review page. This is an issue because that menu is populated by the events returned from the initial search. The solution I've come to is to have two correlation searches, one to trigger my adaptive response and a second to search for both data and trigger only when the collected data has been found as well. The issue with that is suddenly I need two nearly identical searches which is doubling the search load. So, finally: Is there a way to streamline this without having to run two correlation searches in parallel? Is there an addon that someone made that I don't know about that allows us to trigger another correlation search "ad hoc" as an adaptive response? Is there a way to run a correlation search via a python script (which is an adaptive response)? This isn't a one off, I have plenty of searches I need to make this adjustment to so doubling them up is out of the picture, unfortunately. ... View more

Hello all, Potentially a bit of a sensitive topic, but I wanted to see what others thought. Splunk Best Practice are great and really help installations to go smoothly and work optimally, but I can think of at least one case where it's not always practical to follow them. My example is something I have done on all of my ES deployments: Install DBX on the ES SH when needed (best practice is to have no additional apps installed on the ES SH). I do this because some environments use DBX to collect asset data and, while you could index it, it's much simpler to just write directly to a CSV using a scheduled search. Asset data is a type of data where (when using a well made search) the old data is of not actionable value because the newest data should be a complete picture of your environment, so installing DBX on a forwarder and indexing it is a waste of storage paste (regardless of how small) and adds additional complexity that does not need to be there. I understand the reasoning behind "no additional apps on the ES SH" is to prevent bloat and take precious resources away from a very hungry system, but I treat this best practice as a rule of thumb that should be approached at a case by case basis .Having a single search run at 1 AM every day is going to have exactly 0 performance impact, and if it does you've got bigger problems. I've never had any issues doing this, until recently were someone was told to remove DBX from the ES SH because it wasn't a best practice, which caused a few headaches and, in my opinion, caused more problems by fixing an issue that didn't exist. What are your thoughts on this? Do you have any other examples of best practices being a great guideline, but not a rule of law? ... View more

I can't find any documentation regarding the best deployment scheme for this. Looking at the configs I'm thinking: Install it on a Heavy Forwarder and configure that to have the hooks into the repos Install it on Indexers (or at least the indexes.conf file) so the data gets indexed. I don't see any index time opertations. Install it on Search Heads in order to make use of the views, etc Any thoughts? Am I correct in my assessment? Side note: The Splunkgit tag is not recognized in the "tag" search on the sidebar. ... View more