automine

version: '3'

services:
  splunksh:
    hostname: splunksh
    image: splunk/splunk:7.0.3
    environment:
      SPLUNK_START_ARGS: --accept-license --answer-yes --no-prompt
      OPTIMISTIC_ABOUT_FILE_LOCKING: '1'
    ports:

automine

@echo off
del /f /q "%SPLUNK_HOME%\etc\system\local\inputs.conf"
del /f /q "%SPLUNK_HOME%\etc\system\local\outputs.conf"
del /f /q "%SPLUNK_HOME%\etc\system\local\deploymentclient.conf"

automine

#!/bin/sh

[ -d "/opt/splunk" ] && SPLUNKPATH="/opt/splunk"
[ -d "/opt/splunkforwarder" ] && SPLUNKPATH="/opt/splunkforwarder"

[ -f "$SPLUNKPATH/etc/system/local/inputs.conf" ] && rm -f $SPLUNKPATH/etc/system/local/inputs.conf
[ -f "$SPLUNKPATH/etc/system/local/outputs.conf" ] && rm -f $SPLUNKPATH/etc/system/local/outputs.conf
[ -f "$SPLUNKPATH/etc/system/local/deploymentclient.conf" ] && rm -f $SPLUNKPATH/etc/system/local/deploymentclient.conf

automine

version: '3'

services:
  splunksh:
    hostname: splunksh
    image: splunk/splunk:6.6.3
    environment:
      SPLUNK_START_ARGS: --accept-license --answer-yes --no-prompt
      OPTIMISTIC_ABOUT_FILE_LOCKING: '1'
    ports:

automine

Windows TA 5 Changes

Overview

There were changes made in the Splunk Add-on for Windows in version 5.0 which are very different from past versions. With this change, some apps may have issues, such as the Exchange App, Windows Infrastructure app (certain versions), and possibly others. Consultants should be aware of these changes when deciding which version to use with a customer. Below are the Splunk Add-on For Microsoft Windows 5.0.0 changes related to WinEventLog Sourcetypes that may impact Winfra/Exchange/ITSI apps.

Why these changes were made

1. Enhancing code robustness: clean up existing bugs, simplify maintainability, prepare add-on for further enhancements
2. Improve performance
3. Follow knowledge management best practices
4. Remove any unsupported functionality, such as wildcard sourcetyping
5. Produce well-structured code with a dedicated stanza per log format, instead of the previous mix

automine

# Disable the default management listener which binds to 0.0.0.0
# And then set up a new listener that listens on the loopback

[httpServer]
disableDefaultPort = true

[httpServerListener:127.0.0.1:8089]
ssl=true

automine

You should use this: https://github.com/dpaper-splunk/public/blob/master/dashboards/extended_search_reporting.xml

automine

version: '3'

services:
  splunksh:
    hostname: splunksh
    image: splunk/splunk:7.1.2
    environment:
      SPLUNK_START_ARGS: --accept-license --answer-yes --no-prompt --seed-passwd changed123
      SPLUNK_USER: root
      OPTIMISTIC_ABOUT_FILE_LOCKING: '1'

automine

template("$(format-welf ISODATE DATE SOURCEIP HOST ORIG_HOST PROGRAM PID MSGID SDATA MSGHDR MESSAGE FACILITY PRIORITY)\n");
template t_splunk_kv { template("ISODATE=\"${ISODATE}\", DATE=\"${DATE}\", SOURCEIP=\"${SOURCEIP}\", HOST=\"${HOST}\", ORIG_HOST=\"${ORIG_HOST}\", PROGRAM=\"${PROGRAM}\", PID=\"${PID}\", MSGID=\"${MSGID}\", SDATA=\"${SDATA}\", MSGHDR=\"${MSGHDR}\", MESSAGE=\"${MESSAGE}\", FACILITY=\"${FACILITY}\", PRIORITY=\"${PRIORITY}\"\n"); template_escape(no); };

automine

version: '3'

services:
  splunksh:
    hostname: splunksh
    image: splunk/splunk:6.6.3
    environment:
      SPLUNK_START_ARGS: --accept-license --answer-yes --no-prompt
      OPTIMISTIC_ABOUT_FILE_LOCKING: '1'
    ports: