The way I just recently did that was to run a cronjob every 10 minutes that pulls the metrics from haproxy via http in CSV format: curl -s -u <username:password> http://localhost:<stats port>/stats;csv It needs a bit of post processing so you can use the regular CSV data ingest by a universal forwarder. Here is the script I am using: TS=`date +"%Y%m%d%H%M%S"` DIR=<monitored directory> FILE=$DIR/haproxy-metrics.$TS.csv [ -d $DIR ] || mkdir -p $DIR /usr/bin/curl -s -u <credentials> http://localhost:<port>/stats\;csv \ | sed -e 's/^# /# time,/' -e 's/^\([^#]\)/'$TS',\1/' -e 's/# //' > $FILE  The sed command makes sure that a time column is inserted in front with the current time and the '#' is removed from the header. On the forwarder you can configure the inputs.conf to monitor that directory and give it the sourcetype csv or you can roll your own according to this doc page. Splunk will take care of the rest. Make sure you clean out that metrics directory once in a while so they don't collect there forever. ... View more

We POCed Threatstream and now that you mentioned it I just looked for it to have a look. There is absolutely no good reason to have this path whitelisted in distsearch.conf. Actually, it is quite intruding. I would remove this setting or make it more precise like .../threatstream/default/data/model/*.json or some such. We had quite a good line of communication into Anomali to make the app work to our liking. Is that not the case anymore once you purchase their product? ... View more

DUO released an update (1.1.4) of the connector on Splunkbase. ... View more

It's just the name of the input and it is entirely up to you. It's the same value you choose use when using splunkweb where is asks you to name the input. I always use something like "DUO" or "DUO logs". ... View more

Were you able to find out why the validation process took longer than 30 second? What happens is that the validation process of the modular input tries to connect to the DUO API in order to make sure the credentials you provided are correct. If it takes that long you really should do some troubleshooting like telnetting to port 443 of your DUO API host from the forwarder/indexer and take it from there. If you want to create the input for DUO on your own, here is a spec of how it looks like: [duo_input://<name>] api_host = <DUO API host> ikey = <integration key> index = <index> interval = <interval to poll; I would suggest 300 secs as the minimum; the longer the better> skey = <secret key> sourcetype = json source = duo host = duo_api Stash this in an inputs.conf file in local for this app or wherever you like. This will not fix your timeout problem, though. Hope this helps. ... View more

You can calculate the hour of an event with eval/strftime and use search or where to look only at those: <your search> | eval Hour=strftime(_time,"%H") | where Hour="10" | <process the results> ... View more

Splunk opened a bug report for me and we'll see how it shakes out. The inconsistency between the Infoblox and the ISC BIND add-on is reason enough that something needs to be fixed. ... View more

We are experiencing the exact same thing. Intuitively one would think that the destination is the name server and the source is the client when it comes to query logs. We turned on reply logging on our Grid and now the field extractions make more sense, even though theoretically it should still be switched around, i.e. the source is now the name server and the destination is the client. Personally, I think this is confusing and I am going to change the extraction so that src will always be the client and dest the name server, no matter if it is a query or a reply log. All that said, we also have the ISC BIND add-on and in there the src and dest are extracted the way we think it should be. I'll open a case with Splunk (both TAs are provided by Splunk) and see how they want to handle this. ... View more

@richgalloway is correct that it is impossible to delete anything from an index. Once it's indexed the data will stay in there until it rolls out and is deleted. The one thing that you could do is use the "delete" command that will do its best to make sure none of the "deleted" data will be used in searches. See https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Delete for more infomation about the delete command, http://docs.splunk.com/Documentation/Splunk/7.0.2/RESTTUT/RESTsearches on how to do searches via API. ... View more

It's safe to delete eventgen.conf and the samples directory one level above. It's actually required when you want to install an app on an indexer cluster. ... View more

Thank you so much for answering. I think I found the page in the documentation that is relevant to my question: https://docs.splunk.com/Documentation/Splunk/6.6.1/Admin/Configurationparametersandthedatapipeline I just wanted to know which parts of the configuration is needed on what tier of Splunk. I have a multi-tenancy setup and there are a few apps and add-ons that I need to modify in order to make sure they don't step on everybody's feet. So, I go through them and understand what they do and how they do it and modify them by, sometimes, erasing certain configuration files that are not needed on that specific tier. For example, I don't need an indexes.conf file on a search head nor do I usually need inputs.conf on an indexer. Some files, like props.conf and transforms.conf are needed everywhere because they do search-time or index-time transformations and extractions. ... View more

I just took the plunge to check if the current release of this add-on supports MarisDB 5.5. It does work but not all sourcetypes will be available as documented. This is due to the fact that the performance schema is rather lacking in 5.5 and the inputs configured use tables that only exist in 5.6 and up. ... View more