Hi All,  We have a LB sitting in front of two deployment server with health rule of LB defined as https. we tested with a server by updating the deploymentclient.conf with the LB name but the client gets connected and gets disconnected after some time.  The health rule of the LB was configured as https.  Do we need to change  the LB rule  to TCP for this connection to work ?   Regards ... View more

Hi All , we are required to configure ssl on splunk forwarders to communicate to splunk instances. in the official link - https://docs.splunk.com/Documentation/Splunk/8.0.4/Security/ConfigureSplunkforwardingtousesignedcertificates The below steps are given to be configured on the forwarder side. Also we have a third party certificate issuer. Can you please clarify the below queries 1)  we have multiple clients.  i am assuming we can use a single certificate for all clients.        How do we generate the single certificate for all clients. 2)  The below point 2 states that we need to copy the certificate in the below path.  instead can we use a deployment server to issue the certificate ? Configure your forwarders to use your certificates Generate a new certificate (for example, client.pem). Copy the new certificate and the CA public certificate myCACertificate.pem into an accessible folder on the forwarders you want to configure. For example, you can use a destination folder of $SPLUNK_HOME/etc/auth/mycerts/   ... View more

Hi All, I have 4 SH cluster members for which i have to integrate SAML. Our AD team is asking the below information reply URL. Do i need to give all the 4 url ? Also do i need to configure the SAML on all 4 SH UI ? please do share your thoughts. SAML-based Sign-on Attributes Value - Reply URL (Assertion Consumer Service URL) https://searchhead1.group.com/saml/acs https://searchhead2.group.com/saml/acs https://searchhead3.group.com/saml/acs https://searchhead4.group.com/saml/acs ... View more

Hi, We are planning to migrate to migrate to splunk SaaS. The architecture is to use intermediate forwarder and proxy. data flow will be splunk universal forwarder ----> Intermediate forwarder---> Proxy ----> Splunk SaaS. Our security constraints requires the data to go through proxy. Is it something which can be done or we need to have direct connection to splunk SaaS from Intermediate forwarder ? what kind of proxy does it support. Our proxy settings would to put credentials. Regards ... View more

Hi, We are planning to migrate to migrate to splunk SaaS. The architecture is to use intermediate forwarder and proxy. data flow will be splunk universal forwarder ----> Intermediate forwarder---> Proxy ----> Splunk SaaS. Our security constraints requires the data to go through proxy. Is it something which can be done or we need to have direct connection to splunk SaaS from Intermediate forwarder ? what kind of proxy does it support. Our proxy settings would to put credentials. Regards ... View more

Hi All, Currently there are mainframe jobs which is sending data to a splunk instance where the data will be index locally. The data transfer is happening via FTP. Since it's a frame jobs we cannot install splunk forwarders. We are planning to convert from FTP to SFTP. On mainframe side code chane would be done to make it as sftp. So for this what changes would required on splunk side ? I believe a key would required ? Is there better method of transfer or any add-on that we can use ? Regards ... View more

Hi Team, We are trying to reduce the concurrent search count in our environment as upgrading hardware resource is not possible. We have a dedicated alerting which is running about 800 alerts at different frequency. FOR EXAMPLE : There are around 400 alerts which is running at every 15 min interval defined as such - (*/15 * * * *) in cron meaning the alerts are running at 10 AM,10:15 AM,10:30 etc. We are planning to schedule the cron job as such - 100 alerts at 10 AM,10:15 AM,10:30 etc. (*/15 * * * *) 100 alerts at 10:1 AM ,10:16 AM,10.31 AM and so on (1/15 * * * * ) 100 alerts at 10:2 AM ,10:17 AM,10.32 AM and so on (2/15 * * * * ) 100 alerts at 10:3 AM ,10:18 AM,10.33 AM and so on (3/15 * * * * ) 100 alerts at 10:4 AM ,10:19 AM,10.34 AM and so on (4/15 * * * * ) Please suggest if this is a good way of scheduling alerts and do suggest if there are other methods. Regards ... View more

Hi, i am able to get spunk forwarder deaials using below query but i need information like windows 2012,2016, linux version 2,3 ,4 etc. How can we get this OS info. index=_internal source=*metrics.log component=Metrics group=tcpin_connections | dedup hostname | table hostname sourceIp os arch version Regards ... View more

Hi, I have some set of events that has keywords like "inbound message" and "outbound message". the events looks something like this . 2010-02-20 14:12:45.642 | INFO | qtp413909515-1424 - /aaaaaaaaaaaaaaa | uuid:aaaaaaaa | vice.InServiceSOAP.InServicePort | 74 - org.apache.cxf.cxf-core - 3.0.4.redhat-621169 | Inbound Message. I want such event only to be index. on the indexer side, i have created as such but it is not working. how to resolve this ? In transforms : [test] REGEX = Inbound DEST_KEY = queue FORMAT = indexQueue props [testsource] TRANSFORMS-set= test ... View more