To make this automatic, you can add the following to your props.conf on the search head: [netstat] KV_MODE = multi ... View more

If you're looking to whitelist your vulnerability scanner from correlation searches, your best bet is to use the asset and identify framework. When you generate your asset list, you'd identify your vulnerability scanner by either IP Address, hostname, installed applications, etc etc, and give it a category of "scanner" or "known_scanner", or whatever you want. You'd then update the applicable correlation searches to not include anything where "category=scanner". ... View more

What you are seeing seems like normal outputs from ES. The src field is populated by the source host that has generated that event. A number of log sources will often populate this field with IP addresses and not hostnames, such as firewalls and proxies. This is the same for the username you are seeing, there is a log source that has the HealthMailbox account as the user generating that event. HealthMailbox mailbox accounts are a mailbox with an active directory account, which is why there are logs being generated that have it as the user. You can always alter the searches to not include these accounts or src ips, but you should first do some thorough investigation to be sure that these authentication attempts are in fact not anomalies else you might miss threats or attacks in the future. ... View more

Thanks for the context you provided in your comments khanlarloo. If the monitoring console is telling you that you have an indexing rate of 0 but your queues are full, this means either your disk is full, there's a hardware failure or you are out of memory. Have a look at your workstation / server and make sure it hasn't run out of disk space or memory and that there hasn't been any other failure that would impact the operation of Splunk. ... View more

At the top of the Indexing Performance dashboard should be single indicators with "Total Indexing Rate" and "Average Indexing Rate" written beneath them. Are they not showing? Also, how many indexers do you have? Only one, or is it a cluster? ... View more

Can you share a couple of statistics on your indexing health, primarily your queue fill ratios and your indexing rate? These stats can be found in Monitoring Console > Indexing > Performance > Indexing Performance: Deployment ... View more

Hey andrewaalin, Please refer to this forum link that discusses how to extract the asset data out of vmware using the web client: https://communities.vmware.com/thread/504401 Once you have the csv file, you could then import that into Splunk and use it to mold your asset list. ... View more

Looks like an issue with the field alaising. Have you made any changes to the add-on's props.conf file or added a local props.conf file? ... View more

It's 'possible' to install two, but I would not recommend doing so. The impact of running two ES Search Heads can have a catastrophic effect on the peers as you're running double the data model accelerations, plus all the other scheduled searches ES runs in the background. If you want to set up a second ES node for testing (or similar) purposes, it's best to place it on a separate environment. ... View more

Hey Luongg, Yes there should be no issues with these apps working after you've upgraded. I've installed them on other environments which are running Splunk 7.x and haven't had any issues. ... View more

Are you putting ":8000" at the end of your server/workstation IP address? ... View more

Yes, you will lose data as the 151GB is larger than the new maximum size parameter of 50GB. Splunk will remove the oldest data until it reaches 50GB in size. To stop the data from being deleted entirely, you would need to create an archive policy or, as referred to in Splunk terminology, move data to "frozen". Essentially, this means that any data being removed out of the index, either because it's aged out or because the index has reached its maximum size, will be archived. If no archive policy has been created, then the data will simply be deleted. Please refer to the documentation on setting a retirement and archiving policy. You can roll data to frozen with two methods. The first is to specify a frozen directory on the server to move the data to. The second is to run a script which might move the data to a network share for example. Search for "coldToFrozenDir" and "coldToFrozenScript" within the indexes.conf documentation to find more info on this. If you then need to search your frozen data, you have to "thaw" it. To learn how to do this, please refer to Restore Archived Data documentation. ... View more

Exceeding a license limit doesn't stop the data from being indexed. Instead, it will create license violations which may impact other functionality on the Splunk platform, such as stopping you from being able to search your data. For more information on license violations and to determine how you'll be impacted, refer to the following link: http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Aboutlicenseviolations#What_happens_during_a_license_violation.3F ... View more