Hi @AJSCSA, These alerts you have referenced in your post, is this the "alert" that pops up when you log into the Webpage? Can you provide some output as to what the following log shows with lines that pertain to KVStore? On Linux: # tail -f /opt/splunk/var/log/splunk/mongod.log On Windows: # type /opt/splunk/var/log/splunk/mongod.log OR # Get-Content /opt/splunk/var/log/splunk/mongod.log -wait Do let us know what the results yield! V/R, nwuest ... View more

Hi @sg17, I see you are installing the Splunk Universal Forwarder at home.  I also see that you are having trouble with your most recent reply that you are not seeing any data in the "Data Summary" in the Search and Reporting app.  I'm a little confused because you say you are setting up a Splunk Universal Forwarder but a Forwarder comes with the web interface disabled.  A Splunk Enterprise instance does come with a web interface enabled, which makes me think that you are running this and not a universal forwarder.  You don't need to set an IP for a "receiving indexer" in this solution. If you are just trying to look at logs on your local Windows machine with a default Splunk Enterprise install, it will only ingest its own "Splunk" logs (Which come into the "_internal" index.) If you would like to see more logs on the local machine, please look into installing the Splunk Add-on for Windows app to get more Windows related data.  Splunk Add-on for Microsoft Windows  Or you can do some one-off's and look at a single log if wanted. Monitor data  Do look forward to hearing back from you! V/R, nwuest ... View more

Hi @wahluf, You are correct that you need to add RAM to your Splunk Searchhead to improve your search capabilities and performance. See here: Searches are auto-cancelled  Do you happen to know if your Searchhead is a physical server or a virtual machine? If it is a physical server, you will have to do some homework in finding what ram is currently installed on your server and if there are slots for expansion. Also, if your server has two cpu's you will need to buy equal ram modules for each processor otherwise they won't be recognized as part of a memory imbalance between the CPU's. If it is a virtual machine, find out if you have additional resources to allocate to the Searchhead. * NOTE: Work with the necessary parties to ensure that you are able to take what you can. 1. To add ram you will need to "configure" the VM and sometimes this will require that you have to turn off the VM to be able to add/change the resources for that VM. 2. Once the VM is off, you should be able to add the newly allocated RAM to the VM and then save the changes. 3. Now you can turn back on the VM, do ensure that the Splunk Service comes back up and the web page is accessible. * NOTE: If you do have to turn off the Searchhead VM, do let the responsible parties/persons that use the Searchhead of its upcoming maintenance. It will save you a headache and phones calls asking why the server went down. 4. Depending on if you are able to "hot-add" RAM to the Searchhead VM or not, some good housekeeping would be to restart the guest OS which in turn would restart the Splunk Service. This will ensure that Splunk recognizes the newly added RAM and will be able to use it going forward in a clean manner. See Here: Hot-add RAM to a Splunk Searchhead  We do hope this helps you out with your question! V/R, nwuest ... View more

Hi @driva, After reading your post and doing some googling of the Windows "800706BA" error especially showing up in the Splunk logs. A few things come to mind and they are network related: You speak of the necessary firewall rules are in place are you speaking of the firewall logs on the machines themselves or a firewall in between both networks? Have you tried "turning off" the firewalls (AS A TEST ONLY) on either device to see if that clears up the connection issues? If the connection clears up then you can narrow it to a specific device as to which is causing the connection issues, from there it could be a routing issue or a firewall issue. If the connection does not clear up then you can confirm that the issue remains somewhere on a larger level (ie. routing between networks, firewall rules are getting in the way etc. etc.) We do hope to hear from you and if this was helpful! V/R, nwuest ... View more

Hi @shadowit, Kali VM: Your attack platform Ubuntu VM: DVWA application Splunk Universal Forwarder is installed on the Ubuntu machine "i wanted to know how to install splunk forwarder" Check out the following link: Install the universal forwarder on Linux ".. how to configure an output config file" Check out the following link: Configure forwarding with outputs.conf  ** This is to be configured on the Splunk Universal Forwarder Add-on App "Install the *nix app on the Ubuntu VM" Check out the following link: Splunk Add-on for Unix and Linux  This app will help monitor some applicable logs that will be useful to monitoring your activities with the Kali VM attacking the DVWA. "how to add monitor command" Check out the following link: Monitor files and directories with the CLI  This will help you monitor other log files not covered in the *nix app from point 3. Windows 10: Splunk Enterprise instance set up as an Indexer Splunk Enterprise installed as an Indexer/SearchHead Add-on question "How to install Splunk Enterprise" Check out the following link: Windows installation instructions  Follow these instructions to set up the Windows 10 machine as an Indexer "how to configure input config file" Check out the following link: Configure your inputs  ** This is to be configure on the Splunk Enterprise instance set up as an Indexer We do hope this helps get you on your way @shadowit, do let us know your progress and if this has helped. V/R, nwuest ... View more

Hi @sg17, A receiving indexer is a Splunk Enterprise instance that is set up as an Indexer to receive logs from other Splunk instances (Splunk Universal Forwarder / Heavy Forwarder / Splunk Enterprise) A Splunk Universal Forwarder only has the essential components to forward data to other Splunk platform instances (Splunk Heavy Forwarder / Splunk Enterprise)   Are you installing a Splunk Universal Forwarder at home or at work? If you are at home, you can install/configure a Splunk Enterprise instance as an indexer to receive logs from your Splunk Universal Forwarder. Download Splunk Enterprise  Here is the Splunk documentation on getting data in Splunk® Enterprise Getting Data In  If you are at work, does your work have a Splunk Instance to send logs into or use Splunk as their SIEM? We look forward to hearing from you! V/R, nwuest ... View more

Hi @SplunkSanc, Which built-in correlation search are you trying to add an email alert to? (I can try to replicate it on my end) Also, which version of Splunk Enterprise are you running? Look forward to hearing from you! V/R, nwuest ... View more

Hi @gcusello, One thing that you can try that has helped me is on the "syslog" collector that these switches are sending their logs to, is to add the switch and the switches ip to the local host file. For a Linux box that will be /etc/hosts For a Windows box that will be in C:\Windows\System32\drivers\etc\hosts Example for both: 192.168.1.1 tiesse.buttercupgames.local tiesse After this, the syslog collector should start writing the names in the logs that it is receiving from the tiesse network device. From there, the Splunk Forwarder should monitor those logs and send them in with the correct hostname Can't wait to hear if this helps you! V/R, nwuest ... View more

Hi @auzark, This app will get you started with the visualization Traffic Light Visualisations  And this command "rangemap" is referenced by the app which will assist you in getting the data formatted right Search Reference: rangemap    Let us know if this helps you out with your dashboard! V/R, nwuest ... View more

Hi @githubguthub, I was mainly speaking to getting a screenshot of the query AND results. It would just help us to see what you are looking at specifically in relation with the search and results. I have yet to find/have a similar instance in Splunk where the search results are going lower with a larger search window so I'm genuinely interested in your challenge. Hope to hear from you soon! V/R, nwuest ... View more

Hi @githubguthub, To follow @ITWhisperer’s sentiment, is there a way you could provide the results with the search query so we can see the diffferences with each search?  It’s not a lot to go off of with just screenshots of the results but no query.  We definitely look forward to hearing back from you so we can help troubleshoot further! V/R, nwuest ... View more

Hi @Glasses, The Universal Forwarder does not support bringing the webpage up as its main purpose is to: "include only the essential components that it needs to forward data to other Splunk platform instances. While it does not have a Web interface, you can still configure, manage, and scale it by editing configuration files or by using the Forwarder Management or Monitoring Console interfaces in Splunk Web. " Splunk® Universal Forwarder Forwarder Manual  Universal Forwarders have the added benefit of not impacting the host as much as a Splunk Enterprise instance would because they are so lean and do not require a lot of resources to run.   I do hope this helps with your question/post but do let us know if you have any other questions! V/R, nwuest ... View more

Hi @melissap, Thanks to you and all those who put these valuable resources together and publish them for all of us who frequent these forums! I will definitely share these posts with my co-workers. V/R, nwuest ... View more

Hi @abhijitnath89ax, After doing some researching about the error you have depicted could be related to the indexers trying to see if the others indexers/receivers are "alive" named a heartbeat function. View solution in original post by @hliakathali_spl    Would there happen to be a firewall change either in the network and/or a firewall change on the Splunk Indexers themselves that are prohibiting the connection between them?   We hope to hear back from you!   V/R, nwuest ... View more

Hi @jihape, Just a thought, is there a file called “crash.log” in the following folder: /opt/splunkforwarder/var/log/splunk/  If not, is there anything that is popping up in splunkd.log in the same folder?  Look forward to hearing from you! V/R, nwuest ... View more

Hi @sanjubaba, It is possible to gather logs from your local box with applicable apps that you will load into the Splunk Enterprise instance you are referencing. For a linux machine, load this into the splunk instance: https://splunkbase.splunk.com/app/833/ For a windows machine, load this into the splunk instance: https://splunkbase.splunk.com/app/742/ If you are looking for a specific file itself that isn't covered by these apps or any others: Getting Data In Let us know if this helps out with what you are looking for! V/R, nwuest   ... View more

Hi @Cstone1, So if I'm reading this right, you are "restarting" splunk after you upgrade it? If so, that is where the script is breaking. After you upgrade a Splunk Instance, you need to accept the End User License Agreement again before it will even start. Splunk cannot "restart" an instance that hasn't made it past the End User License Agreement step. You can accept the license but instead of "splunk restart" you should use the following command depending on your splunk instance: Splunk Enterprise: "/opt/splunk/bin/splunk start --accept-license" - OR- Splunk Universal Forwarder: "/opt/splunkforwarder/bin/splunk start --accept-license" Let us know if this fixes your script! V/R, nwuest ... View more

Hi @chrodriguez  Try this: EventCode=4624 | dedup ComputerName | table ComputerName _time View solution in original post  Let us know if this works for you V/R, nwuest ... View more

Hi @vikramyadav, Fixing my previous tail command, it should be this one for Linux. LINUX: If you don't have the "watch" command you can always tail the /opt/splunkforwarder/var/log/splunk/splunkd.log for the applicable app. # tail -f /opt/splunkforwarder/var/log/splunk/splunkd.log | grep "program name"   We hope to hear your progress! V/R, nwuest ... View more

Hi @jknulst  Thanks for the clarification.  Splunk is able to send data to third party systems Forward data to third-party systems  I’m more than sure that Splunk will be able to load balance as long as you add them to your outputs.conf file.  Be sure to update us on your progress with the 3rd party receivers.  V/R, nwuest ... View more

Hi @vikramyadav, I see you are getting a ""REST Error [500]: Internal Server Error " based on the logs you provided. Have you tried searching the splunkd.log for any more concise information as to why the app isn't working? LINUX: If you don't have the "watch" command you can always tail the /opt/splunkforwarder/var/log/splunk/splunkd.log for the applicable app. # tail -f /opt/splunkforwarder/var/log/splunk/splunkd.log | grep "TcpOutputProc" WINDOWS: If you are currently running on a windows box and have access to powershell you can use the following command to see the output of splunkd.log (Open powershell in admin mode) # Get-Content -Path "C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log" -Wait It will chunk through the file until it gets to the end but run this before you access/re-install the app again. Look forward to hearing from you V/R, nwuest   ... View more

Hi @troyfred, I see you are trying to work with a client on utilizing a heavy forwarder without indexing. On the topic of the client wanting to use "Their Heavy Forwarder" vs. a Universal Forwarder: I'm unsure how firm your client is with wanting to utilize a Heavy Forwarder over a Universal Forwarder but here is an article that is a great read on the differences between the two. Definitely keep the dialog open between you and the client so you can offer suggestions/solutions to their current challenges. Universal or Heavy, that is the question?   On the topic of "Index and Forward" for the Heavy Forwarders: Heavy Forwarders will typically only take data in and forward it on to its target environment/machine. If your client does not want to "Index" data twice, once at the Heavy Forwarder and again at the Indexer, they need to not include the "indexAndForward = true" setting in the tcpout stanza of the outputs.conf file. [tcpout] indexAndForward=true View solution in original post  On the topic of sending over only "selective" indexes: Route and filter data  I do hope these articles / comments / suggestions work for you. Please comment back to know how this dialog progresses with you and your client! V/R, nwuest   ... View more