I'm in the phase of the migration of the splunk component, where i need to migrate some add-ons from older sh and move it to new SH, coping the TA_crowdstrike-devices from old server to new server will this work? ... View more

We have migrated the Old SH on new SH on new hardware, where i need to migrate the old Enterprise Security, to new SH which has been upgraded to new version 9.0.1, i need to migrate Enterprise Security with all use cases.     ... View more

i have installed the deployment server where configured required inputs.conf and outputs.conf for ingesting logs from UF to my indexer  on the deployment-app of deployment server, and configured the UF forwarder to the deployment server, i found the new host details in the deployment server under the forward management tab. And pointed to appropriate classes and apps from the forward-management  configuration. Still I'm not able to get the logs on the indexer. when i see the error on the Splunkd log of uf. Find the below error   11-20-2023 17:25:40.602 +0400 ERROR X509Verify - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) failed validation; error=7, reason="certificate signature failure" 11-20-2023 17:25:40.602 +0400 WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read server certificate B', alert_description='decrypt error'. 11-20-2023 17:25:40.602 +0400 WARN HttpPubSubConnection - Unable to parse message from PubSubSvr: 11-20-2023 17:25:40.602 +0400 INFO HttpPubSubConnection - Could not obtain connection, will retry after=86.429 seconds. 11-20-2023 17:25:40.778 +0400 INFO WatchedFile - Will begin reading at offset=2295058 for file='/var/log/audit/audit.log'. 11-20-2023 17:25:46.129 +0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/var/log/anaconda/ks-script-lk6ot_yw.log'. 11-20-2023 17:25:46.130 +0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/var/log/anaconda/ks-script-wo9l091q.log'. 11-20-2023 17:25:49.856 +0400 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 11-20-2023 17:26:01.857 +0400 INFO DC:DeploymentClient - channel=tenantService/handshake Will retry sending handshake message to DS; err=not_connected 11-20-2023 17:26:07.910 +0400 INFO ScheduledViewsReaper - Scheduled views reaper run complete. Reaped count=0 scheduled views 11-20-2023 17:26:07.914 +0400 INFO TcpOutputProc - Removing quarantine from idx=192.168.1.5:9997 11-20-2023 17:26:07.914 +0400 INFO TcpOutputProc - Removing quarantine from idx=192.168.1.6:9997 11-20-2023 17:26:07.921 +0400 ERROR TcpOutputFd - Read error. Connection reset by peer 11-20-2023 17:26:07.928 +0400 ERROR TcpOutputFd - Read error. Connection reset by peer ... View more

as i was trying to integrate with AWS UAE region cloudtrail, but haven't observed any details on the add on, there may regions missing as observed. any idea how we can go for the integration. ... View more

HI, i'm facing one of the issue on my heavy forwarder is not able to get the logs on 9997, where we have already configured the UF for port 9997 and receiving port 9997 on HF, but from the source to HF we telnet the HF on port 9997, for the first time it gets connected very next time it failed to connect. due to this we have not receving UF logs on the ... View more

We have multiple devices forwarding the logs to Splunk which syslog mechanism and UF, as it's difficult to identify the forward mechanism used for those devices. is there any way to identify the syslog forwarding mechanism on port 514 ? ... View more