Have you ever been in a situation where you needed to mass-edit a large number of knowledge objects on a search head cluster? Any Splunk admin that has ever had to redirect data to a new index knows how painful this can be. Today, I'm going to teach you the easy way to do it, without even having to restart splunk!

Here are the steps:

1. Find the SHC captain via Splunk Web (Settings -> Search Head Clustering) or via CLI splunk show shcluster-status
2. SSH into the captain node and sudo to the splunk user
3. Perform a git clone https://github.com/masonsmorales/splunk_script_update_files or copy the contents of the update_files.sh bash script and update_files.txt file from a browser. (Note: If you copy them manually, you'll need to do a chmod +x on update_files.sh)
4. Move the two files into the topmost directory that you want to change knowledge objects for. This could be the entire $SPLUNK_HOME/etc folder, only $SPLUNK_HOME/etc/apps, or a specific app.
5. Edit the update_files.txt contents to your liking. The file should contain a list of filenames and/or patterns that you want to perform the find/replace operation against.
6. Edit lines 7 of update_files.sh with the original text that you want to find, and line 8 with the new text you want to replace it with.
7. As a best practice, always take a backup of whatever you are going to change. e.g. tar czvf splunk_etc_bak.tar $SPLUNK_HOME/etc
8. After you've taken a backup and completed your edits, run the script to update the configuration files on disk. e.g. ./update_files.sh
9. Once the script has completed, you'll need to force Splunk to reload the on-disk Splunk configurations on the captain. The quickest way to do this is by restarting only the Splunk Web service. Here's the command: splunk restartss (Clarifying Note: SS = Splunk Search. This command is an alias to splunk restart splunkweb)
10. Finally, once the previous command has completed, SSH into each of the slaves and force them to download the latest bundle from the captain by executing: splunk resync shcluster-replicated-config
11. That’s it! All that's left is to validate your changes. From one of the slaves, cat one of the file paths that the script updated and confirm that the file contents reflect your changes.

Just a few notes on settings that everyone should be thinking about when creating custom sourcetypes or technology add-ons in Splunk...

Data Parsing
Do you have these configurations in props.conf?
SHOULD_LINEMERGE =
LINE_BREAKER  =
MAX_TIMESTAMP_LOOKAHEAD = 
TIME_PREFIX =
TIME_FORMAT = 
TRUNCATE =

More Data Parsing...
ANNOTATE_PUNCT = false (if you don't need the punct field)
TZ = (if it's not part of the timestamp in your data)
CHARSET = UTF-8 (usually)
NO_BINARY_CHECK = true
KV_MODE = 

Check out Splunk's documentation on props.conf for help with these settings.

Field Extractions
Are you extracting fields for your users at data on-boarding? You should be! Splunk tends to grow organically and if your data isn't well-groomed when you bring it on, it may never be. Setup your users for success by identifying the fields they need and getting them extracted when you on-board their data. 

Be sure to use either EXTRACT in props.conf or a REPORT in props.conf and corresponding REGEX/FORMAT in transforms.conf.

For CIM compliance, use this as a guide: http://docs.splunk.com/Documentation/CIM/4.12.0/User/Howtousethesereferencetables
 
Or, consider using the Splunk Add-on Builder
​
A word on community-built/3rd party apps and addons....

• For COTS products, be sure to check splunkbase.com and github.com for any community built technology-addons. Sometimes you have to modify them a bit to get them working with your data, but they can potentially save you some serious time.
• Don't be afraid of customizing community-built addons, or ripping out pieces you don't want (like eventgen.conf, indexes.conf, KV stores you don't plan to use, etc.).
• Finally, be sure to test anything you download for Splunk in a development environment before installing it in your production environment.  Setting up a test environment can be as simple as spinning up Splunk on your laptop, setting up a vagrant host to run Splunk, or even using a docker image of Splunk. All you need is a sample of your data and a test environment to see if everything will work right.
• Once you have installed a TA in a test environment, be sure to check for startup errors (or simply run splunk cmd btool check. This will tell you if there are any syntax errors in the config files. You can also search the _internal index on your test instance for log_level=ERROR with something like the following: data_source="*" OR data_host="*" OR data_sourcetype="*" You can replace the "*" with the source, host, or sourcetype that you are trying to ingest. This can uncover problems with data parsing, event breaking, etc. that you might not otherwise be aware of

I feel like security is an often overlooked part of being a Splunk Engineer. This blog post is all about the importance of securing Splunk and the systems that it runs on. In addition to following the Securing Splunk guide in Splunk Docs, here are some other best practices you should be thinking about...

1. Running Splunk as a non-privileged user (i.e. not root)
2. Forwarding your local system messages and audit logs to syslog (and then of course to Splunk)
3. Forwarding all _internal, _introspection, and _internal logs from all non-indexing instance of Splunk to your indexers
4. Configuring host-based firewall rules (e.g. IPTABLES, ufw, or firewalld) for both inbound and outbound connections, specific to port, protocol, and destination host/network(s)
5. Deploying additional open-source security tools to your core Splunk servers, such as OSQuery, OSSEC, or ClamAV
6. Splunking your bash history
7. Disabling the REST port on forwarders when it's not needed
8. Mitigating the POODLE attack in Splunk Web
9. Changing default certificates used for Splunkd, Splunk Web, etc.
10. Using encryption for Splunk to Splunk (S2S) connections
11. Hardening SSH on your Splunk servers
12. Enabling 2FA for SSH 
13. Restricting who has the admin role in Splunk to only a handful of users
14. Implementing patching and vulnerability management policies
15. Hardening the operating system of your Splunk servers using the CIS benchmarks, along with other security controls recommended by NIST, SANS, etc.
16. Enabling data integrity control on all of your indexes
17. Using a common splunk.secret file so that you can securely deploy passwords via configuration files 
18. Using different SSH key pairs for each environment and rotating them periodically
19. Securely storing passwords, secrets, API keys, and other sensitive information using a secret manager like Vault by HashiCorp
20. Disabling Splunk Web on hosts that don't need it (think indexers and heavy forwarders)
21. Changing the default password for the admin account by deploying a user-seed.conf file with a pre-hashed password
22. Randomly generating long passwords for service accounts, or using Splunk's new token-based authentication system for REST API access.
23. Restricting usage of the admin account so that you can properly audit who is making changes through Splunk web or Splunk CLI
24. Enabling SSL on Splunk Web with certificates signed by a trusted CA
25. If you're an app developer, storing passwords using the KV store instead of in plain text contained in configuration files

I recently upgraded a Splunk cluster from v6.5.2 to v7.0.1. There was one thing that wasn't covered in the release notes. After upgrading my first host (master node), I couldn't execute CLI commands. Splunk threw the following error:

Splunk Support admitted that they have some SSL bugs in the new release, and that this was one of them. To workaround this, you can make the following edits in server.conf:

Once this is done, restart Splunk and try the CLI again. You should be back in business.

I had to update server.conf on most of my Splunk server hosts (master node, search heads, deployers, deployment server, license master, etc.) but for some reason not on my indexers. I'm not sure why as both my indexers and search heads run the same OS and had the same OpenSSL package installed. Hopefully this helps anyone out there with a similar issue.

Do you use Heavy Forwarders in your organization? Perhaps you have one installed on your syslog server, or on a dozen syslog servers? Chances are that your host field is already being used to identify which host generated any particular event, which is exactly what it was designed to do. But, what if you need to identify where that data is coming from? That's where indexed fields can help out.

I like to call this indexed field, "splunk_forwarder" because it's not one of the fields Splunk uses by default (e.g. splunk_server), and it's easy to remember.

First, we'll create a fields.conf file on our search head(s) to tell Splunk about our indexed field:

[splunk_forwarder]
INDEXED = true

Next, we'll add an inputs.conf file to our heavy forwarder that creates the new field along with its value:

[default]
_meta = splunk_forwarder::myforwarderhostname

This configuration will create a new indexed field called, "splunk_forwarder" and will set its value to whatever you put after the double colons. In this case, it will be assigned a value of "myforwarderhostname". I typically use the hostname of the heavy forwarder, but you could also use the IP address, FQDN, etc.

Finally, restart Splunk on your heavy forwarder and search head(s). Any new data that gets indexed will automatically have your new splunk_forwarder field!

Now, you can run cool searches like this one to quickly see which forwarders are sending what data to Splunk:

| tstats count  where splunk_forwarder=* index=* by splunk_forwarder sourcetype index | stats values(index) as index values(sourcetype) as sourcetype sum(count) as count by splunk_forwarder ​

New to Splunk? This is a list of learning resources that I've curated for new Splunk users over the years. Feel free to share this with your fellow Splunkers!

• Splunk Quick Reference Guide
• Splunk Answers/Community Forum
• Exploring Splunk eBook (free)
• Splunk Intro Course (free)
• Splunk Education Videos
• Splunk Documentation
• Splunk's Global User Group Conference​