Hi All, I have recently upgraded Splunk HF from 7.3.x to 8.1.2 and also the Cisco eStreamer (Encore) app from 3.6.x to 4.8.1. Both upgrades went fine and cisco:estreamer:data logs were coming in fine till 1.5 hours post-upgrade after which logs stopped coming in. The file  estreamer.log in /opt/splunk/etc/apps/TA-eStreamer/bin/encore doest show any ERROR ( INFO     Running. 3500 handled; average rate 4.86 ev/sec;). Also, I'm able to see logs populating in /opt/splunk/etc/apps/TA-eStreamer/data. However, it appears logs are not getting updated in cisco:estreamer:data sourcetype. There are other log sources relayed from the HF to cloud which do not have any issues (ruled out any network connectivity issues between HF and splunkcloud). Has anyone else seen similar issues? ... View more

Hello All, I was looking for download link for Splunk enterprise 6.6.1 but it appears it is not listed here  https://www.splunk.com/en_us/download/previous-releases.html#tabs/linux . Is there any other download link available? ... View more

Hello All, I'm trying to prevent the 'USERID' events from getting indexed by making the following changes on my Heavy Forwarder. However, after adding the TRANSFORMS-null statement and the [setnull] stanza in transforms.conf, I'm not seeing any logs getting indexed at all. Any guidance is appreciated inputs.conf [monitor:///var/log/palo] disabled = false sourcetype = pan:traffic   props.conf [pan:traffic] TRANSFORMS-null = setnull TZ = America/New_York TRANSFORMS-host = paloalto-host DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = true disabled = false pulldown_type = true   transforms.conf [paloalto-host] SOURCE_KEY = _raw FORMAT = host::$1 DEST_KEY = MetaData:Host [setnull] REGEX = ^(?:[^,\n]*,){3}USERID DEST_KEY = queue FORMAT = nullQueue ... View more