Hello guys!,   I have a month trying to forward my logs from iMacs using the UF with the following format:       Resources,line,data,process 2023-09-30T06:35:02,"Scanned disks....... " 2023-09-30T06:35:02,User: ...... 2023-09-30T06:35:02,........... 2023-09-30T06:35:02,............ 2023-09-30T06:35:02,Time of completion: ..........       but when the log get into Splunk it only shows the first row:     Resources,line,data,process       and the rest of the log reaches splunk 6 hours later.   I've added the following rule in props.conf but it still failling. path: /Applications/SplunkForwarder/etc/system/local/props.conf        [name_of_my_sourcetype] CHARSET=UTF-8 TIME_FORMAT=%Y-%m-%dT%H:%M:%S, TIME_PREFIX=^ LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true SHOULD_LINEMERGE=true TZ=America/Mexico_City disabled=false     Every change I made I always restart the splunk forwarder using ./splunk restart I have no access to the Splunk server (SSH) but if needed I could try to make some configurations but I do not where.        

Hi all, I try to develop a custom Python script and i want to input parameter from Search to my script. Could i do it? Example my script name is compare (already register on searchhead), and it need 2 parameter to work, like:  | makeresults a=1 | compare file1.csv file2.csv (file1.csv, file2.csv is parameter). Thanks so much.

I'm in General Settings. I Enabled SSL (HTTPS) in Splunk Web. I restarted Splunk. It reads unable to connect. Warning Potential Security Risk Ahead because it is a self sign certificate. I pressed on Go Back Button(Recommended) when I should of pressed advanced and continue. Now All I get is a window That reads Unable to Connect. The Warning Potential Security Risk Ahead window is no longer available. I can't press advanced and continue. What do I do? I can't access Splunk. The connection was reset it says.