Yes, that is correct. I believe before running 6.1.1, I was on 6.0.2, prior to that I had 5.3.1. This particular installation has been progressively updated since about 4.0.2 probably.  Upgrading to 5.3.0 was the point where you didn't need to stage the upgrade on another standalone and then copy the packages over, you run the installer from the deployer, and that updated the necessary packages. ... View more

I can only tell you what it does when it works 🙂 once you upload it, it prompts you to configure it, you go through the configuration as usual, and either before or after that, it needs to restart Splunk, after you restart it, you should be good to go, and the configurations should all be updated in the %SPLUNK_HOME%/etc/shcluster/apps directory. ... View more

just as a thought, maybe you ran into the upload limitation in the web gui?  there is a note in there near the top stating you need to increase the max_upload_size to 1024 (1GB).  If you don't do this, the install of the ES package will fail as it will terminate the upload to the Deployer early, and nothing will work then.   ... Increase the Splunk Web upload limit, for example to 1GB, by creating a file called $SPLUNK_HOME/etc/system/local/web.conf with the following stanza. [settings] max_upload_size = 1024   ... ... View more

no, it used to be that you had to manually copy the files over to the shcluster/apps directory, but now that is automatic. On installation of the application to the Deployer, it should detect the existing copy of Enterprise Security in %SPLUNK%/etc/shcluster/apps, and it will automatically update them as a part of the installation you run on the SplunkWeb part of the deployer. The relevant information is https://docs.splunk.com/Documentation/ES/6.2.0/Install/InstallEnterpriseSecuritySHC - look under the heading "Installing Enterprise Security in a search head cluster environment" ... View more

This does work with the latest version of sysmon (10.42 at the moment). I did have to make a few changes to enable this: download the latest version of sysmon, extract all the files into TA-sysmon-deploy\bin ( should be sysmon.exe, sysmon64.exe, and eula) edit the deploy.bat file, replace all of the instances of "System Monitor v8.00" with "System Monitor v10.42" generate an updated config.xml file for this version, you can pull the latest updates from the git repo "https://github.com/olafhartong/sysmon-modular" I did get some errors at times in the script where it would report a failure on upgrading the sysmon executable, but when I manually verified, the installation was successful and it was a false negative. you will probably need to restart the splunkforwarder service after each sysmon upgrade, as the forwarder doesn't pick up the new event log entries without a restart. ... View more

a lot has changed in the way you set up parsing addons since this was initially made. Back in Splunk 6.x normally you would see FIELDALIAS rules for all fields that the data provided to normalize it. FIELDALIAS frequently causes problems now due to the new way it works, and NULLs overriding actual data is a problem if there is no source field matching the FIELDALIAS definition. Back in Splunk 6.x, you would not have this issue, as the lack of a source field (s_computername) would result in the FIELDALIAS getting skipped, and the host field you already had would still be there when you search. On the other hand, overriding host for Splunk data on a forwarder is unneccessary in most cases, as the host field would already exist, it would make sense for the maintainer of this add-on to remove or disable this one in particular. ... View more

I saw this error too, I found the issue is due to a mismatch in case sensitive file systems. the easy fix is to change the name of the file: lookup_editor/appserver/static/js/utils/FormatTime.js to lookup_editor/appserver/static/js/utils/formatTime.js other option would be to edit these files: lookup_editor/appserver/static/js/lib/HotEditors/DefaultEditor.js lookup_editor/appserver/static/js/lib/HotEditors/TimeEditor.js lookup_editor/appserver/static/js/views/TableEditorView.js and change the line: formatTime: '../app/lookup_editor/js/utils/formatTime', To formatTime: '../app/lookup_editor/js/utils/FormatTime', ... View more

This might be related to a bug on the FMC, where the estreamer service will peg a cpu at 100 percent if FireAMP or File events are enabled. Cisco tracks this as bug #CSCvj07843 I was able to get this working by disabling the event types in the FMC, only allowing intrusion and malware events, and now I am getting events in splunk, but that is still running 30 minutes to an hour behind. This does not seem to be related to the estreamer usage on the splunk/client side, but on the FMC instead. I'm guessing with the additional protocol support added in 3.5.0, the estreamer service on the server side is slowing down too much. From the bug report, fixed versions of the FMC are 6.2.2.4, and 6.2.3.2. ... View more

I had to back out to the older version 3.0 and the events came back. I don't know why, but the estreamer process will start, and I get a short burst of events, but stops and nothing happens from that point on. ... View more