Howdy Splunkers,   Working on my Splunk deployment and ran into a funky issue. I am ingesting Palo Alto FW and Meraki network device logs via syslog server. Rsyslog is set to write logs down to a file and the UF is set to monitor the directories.   No issues there, however I do run into an issue why I try to source type or set an index for these logs. I have edited the indexes.conf in the local folder on my cluster manager and pushed the required indexes to my indexers.  When I go to search for the logs on my search head I cannot find any data. However it works properly whenever i do not have sourcetyping and index destination in my inputs.conf. Any idea as to why?

Hi,  I'm trying to create a filter based on a threshold value that is unique for some objects and fixed for the others. index=main | loopup thresholds_table.csv object output threshold | where number > threshold   The lookup contains something like: object threshold chair    20 pencil  40   The problem here is that no all objects are inside the lookup, so I want to fix a threshold number for all other objects, for example I want to fix a threshold of 10 for every object except for those inside the lookup. I tried these things without success: index=main | loopup thresholds_table.csv object output threshold | eval threshold = coalesce(threshold, 10) | where number > threshold index=main | fillnull value=10 threshold | loopup thresholds_table.csv object output threshold | where number > threshold index=main | eval threshold = 10 | loopup thresholds_table.csv object output threshold | where number > threshold   The objective is identify when an object reach an X average value, except for those objects that have a higher average value.