Hi all, I have a situation where there are servers from which we wish to get logs into Splunk. However, we cannot use the traditional Universal Forwarder because these servers are not allowed to connect through the firewall to the indexer. We can go from "inside" the firewalled network to these servers "outside" the network. So we could perform some sort of API calls if necessary. Is there a way to set up a Heavy Forwarder to poll the servers "outside" the network and pull in the logs? Does the UF support being a "server" instead of a "client", meaning UF would expose an API that could be queried by an HF? Any and all suggestions (aside from reconfiguring firewall) are welcome, thanks! ... View more

Hi all, I'm dealing with a legacy Splunk installation where I'd like to clean up an index for consistency. Lets say I have an index called 'mydata'.  This index is active and has events indexed there fairly regularly (i.e. many times a minute) Previously, this index was defined manually in /opt/splunk/etc/system/local/indexes.conf. The home path was specified as /opt/splunk/var/lib/splunk/mydatadb/db'.  (NOTE: the folder 'mydatadb' in the path) Most of our other indexes use the notation of having the home path folder the same name as the index.  I would like to migrate this existing index to use this pattern. Can I simply update indexes.conf to use '/opt/splunk/var/lib/splunk/mydata/db' then manually rename the folder in the filesystem, and restart the indexer? Is there any metadata or anything else in the db that would cause this path change to break the indexed data?   ... View more

I need to add to the PATH environment variable used by Splunk Universal Forwarder. I have tried editing splunk-launch.conf and I have checked the envvars using splunk envvars but this doesn't seem to set the path. Is it possible to set the PATH variable that Splunk uses? (Note, I only want to setup this specialized PATH for the splunkd instance. I do not want it to be systemwide) ... View more

Is it possible to ingest information from multiple ServiceNow instances using a single "Splunk Add-on for ServiceNow"? We have multiple ServiceNow instances, and a single Splunk infrastructure we would like to ingest into. My current strategy is multiple "apps" in Splunk, one for each ServiceNow instance. Can I configure a single apps/Splunk_TA_snow to ingest from multiple ServiceNow urls? ... View more

I'm using Splunk_TA_windows addon as a deployment app. In the local/inputs.conf, I've added a stanza to monitor Windows Event Log where the channel does not exist on all the Windows computers where the Splunk_TA_windows app is deployed. This is causing errors in the splunkd.log. It is possible to configure the inputs.conf for specific computers, or suppress error logging on inputs which are known not to exist on all computers? Is the only answer to make another deployment app for the specific servers? ... View more

I am trying to make some reports for apps and deployment apps. I was able to use: | rest /services/apps/local to get the label, version, author and description of local apps. How do I do I get this same information for the deployment-apps? I've tried | rest /services/deployment/server/applications but it does not show the label, version, author or description? ... View more

I am trying to make a custom Addon with a setup.xml In the Splunk deployment that I am targeting, the management port has been changed from 8089 to 18089 (to avoid port conflicts with existing services). After I install my app, I do see a 'Set up' action in the Apps list for my app. But when I try to go to the Set up page by clicking on the link, I get a 404. I've read about other addons with setup that indicated the problem may be that the management port is not 8089. How to I configure my app to use the correct management port? ... View more

I am making an add-on that will be installed in a couple of different splunk environments. The different splunk environments use different index names for the "same" data. I would like to make my search string somehow configurable, so the index that it searches can be configurable by the end user. I know there are the $token$ values that can be used in panel search queries. Is it possible to populate the $token$ value from a local .conf file perhaps? I found a related questions here: https://answers.splunk.com/answers/221617/retrieving-values-from-config-file.html UPDATES: It looks like the setup.xml is what I need to include in my app: https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Setup.xmlconf ... View more

I'm using the Splunk for Windows addon on many computers. It has a scripted input for installed apps that runs once a day. Normally, this is what I want (only to collect the data once a day). However, if I am installing new software on all the computers, or uninstalling, I would like to force this script to run on all computers and send the data back to Splunk for a report. Is this possible? ... View more