About realhippo33

realhippo33 · ‎10-12-2020

The answer is to update the version number in the xml file to match the version of Stream.

realhippo33 · ‎10-11-2020

Hi, Does anyone else see these errors with Stream 7.3 and custom vocabularies? 2020-10-12 03:42:50 FATAL [140491587887936] (main.cpp:1150) stream.main - Failed to start streamfwd, the process will be terminated: Incompatible configuration file (run pupgrade.py): /opt/splunk/etc/apps/Splunk_TA_stream/default/vocabularies/procera.xml

realhippo33 · ‎08-20-2019

Sounds like you didn't install the forwarder app you can download from your Splunk Cloud instance. It will have all the right settings and certificates to send data to Splunk Cloud.

realhippo33 · ‎12-18-2018

DEST_KEY = _MetaData:index Should be DEST_KEY = _MetaData:Index 2 hours well spent 🙂

Posts	4
Solutions	1
Karma Given	3
Karma Received	1
Member Since	‎12-18-2018

Online Status	Offline
Date Last Visited	‎02-04-2021 06:47 PM

Stream 7.3 with custom vocabularies

Re: Stream 7.3 with custom vocabularies

Stream 7.3 with custom vocabularies

Re: Splunk Heavy Fowarder to Splunk Cloud using DB...

Re: Can I use CLONE_SOURCETYPE to send events to m...