Hi Splunkers, My greetings !! !! I have data coming from the Syslog server for which sourcetype Is "syslog", now, I have split the data going to three diff indexers in transfroms.conf using MetaData:Index and using the regular expression like (abc* | xyz* ), and it is working fine. Now, I need to hardcode the sourcetype for each of the data going to the different index, now the sourcetype is coming as "syslog" but I want for every separate index I need to have separate sourcetype name .   Can you plz help !! 

My webhook endpoint needs to retrieve the results of the alert that was triggered. Am I correct in thinking that the payload's "sid" value is the same as the Enterprise REST API's {search_id} value in the search/jobs/{search_id}/results endpoint? I'm a little surprised the webhook docs don't say anything about this since it seems like the logical next step. Normally I'd just try it myself, but we're in a gigantic corporate environment, there's tons of paperwork to get permission to do anything, etc. etc. -- much faster to just ask if I'm on the right track. And, I guess, the other obvious question is, if I'm not on the right track, how do I retrieve the search results based on a webhook payload? Thanks in advance!

I'm in the middle of doing historical data migration form on-prem indexers to S3 in Splunk Cloud. Some of the data is making it through, but I'm getting a ton of these type messages in splunkd.log on the on-prem indexers: WARN S3Client - Error getting object name = <...GUID/receipt.json(0,-1,) to localPath = /opt/splunk/var/run/splunk/cachemanager/receipt-(some numbers.json>  

Hello All, I have faced interesting issue. I have an ingest time extraction. [extract] REGEX = ^([^\r\n]+)$ FORMAT = message::$1 DEST_KEY = _raw Truncation not the case, I set it to zero and the whole event is not longer than 5000 characters BUT the message field is truncated exactly after 4023 characters. Where it is written that an extracted field cannot be longer than this amount of characters. Thanks.

Hello everyone, I am currently working on the integration of Citrix Netscaler to Splunk. I`d like to see the App-/Netflow data in Splunk to use those for traffic balancing. My setup is as follows: Splunk v8.2.4 Splunk App for Stream v 8.0.2 (and the TAs as well) Splunk Add-on for Citrix NetScaler v8.1.1 I was following the docs and installed as described. The files from TA Citrix are copied to stream app (https://docs.splunk.com/Documentation/AddOns/released/CitrixNetScaler/ConfigureIPFIXinputs). Eventhough - the netflow elements appear, they are not getting decoded and I am seeing this: Following IANA i was able to figure out that "5951" is ID of manufacturer: https://www.iana.org/assignments/enterprise-numbers/enterprise-numbers (which is Netscaler in this case). Unfortunately i did not find any documentation on the decoding procedure for those bytes. While trying to understand what the streamfwd binary does and how the solution is embedded into the python scripts, I stumbled over one interessting fact. in $SPLUNK_HOME/etc/apps/splunk_app_stream/bin/splunk_app_stream/models/vocabulary.py there is a refernce to this URL: "http://purl.org/cloudmeter/config" which seems to be involved into decoding somehow. However when i try to open this, it shows 404. Coming back to the original issue: those Appflows are not decoded. Is there a known solution for this? If not, does anyone know, where those element definitions may be found?   Many thanks in advance! Best Stan   PS: Seems to be related to https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-decode-netflow-elements-Key-Values-pair/m-p/595345  

I have a HEC output coming to my hec receiver services/collector/event?auto_extract_timestamp=true I want to extract time from field named "time". The format of the event is like  { "event": { "@timestamp": "2022-05-05T10:22:44.965Z" "time": 1651746176018, "my_text": "Pony 1 has left the barn" } }   I also have a prop.conf that have following configuration: CHARSET=UTF-8 KV_MODE=json LINE_BREAKER=([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD=13 NO_BINARY_CHECK=true SHOULD_LINEMERGE=true TIME_FORMAT=%s%3N TIME_PREFIX=\"time\": In result, my timestamp is extracted from field "@timestamp" and I was experimenting a lot with TIME_PREFIX field. But when I manually upload the json with a file, the field I need is parsed ok and "@timestamp" is ignored. 

Hello, I recently setup a test environment(clustered deployment) on  AWS  to monitor and get data into the peer nodes. My environment include: cluster master(hosting license), 3 Indexers, 1 Deployer, 3 Search heads, 1 Deployment server and 2 Universal forwarders.  I configured the deployment server to push configuration to the forwarders, and all seem working fine; the forwarders are phoning home, their is sync between the DS and the UFs. But the peer nodes are not receiving the data. even though, I set up the listening port (9997). I did troubleshoot on the UF to see if they are pushing, excerpt of the output from the UFs: 05-05-2022 11:02:11.118 +0000 INFO HttpPubSubConnection [3276 HttpClientPollingThread_71E59550-AD46-4814-8460-DB66C1DD0BAD] - Running phone uri=/services/broker/phonehome/connection_172.31.28.182_8089_ip-172-31-28-182.ec2.internal_uf01_71E59550-AD46-4814-8460-DB66C1DD0BAD 05-05-2022 11:02:25.767 +0000 INFO TailReader [3323 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log' 05-05-2022 11:02:31.076 +0000 INFO AutoLoadBalancedConnectionStrategy [3316 TcpOutEloop] - Connected to idx=172.31.21.254:9997, pset=0, reuse=0. using ACK. 05-05-2022 11:02:55.767 +0000 INFO TailReader [3323 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log' 05-05-2022 11:03:01.006 +0000 INFO AutoLoadBalancedConnectionStrategy [3316 TcpOutEloop] - Connected to idx=172.31.22.208:9997, pset=0, reuse=0. using ACK. 05-05-2022 11:03:11.118 +0000 INFO HttpPubSubConnection [3276 HttpClientPollingThread_71E59550-AD46-4814-8460-DB66C1DD0BAD] - Running phone uri=/services/broker/phonehome/connection_172.31.28.182_8089_ip-172-31-28-182.ec2.internal_uf01_71E59550-AD46-4814-8460-DB66C1DD0BAD 05-05-2022 11:03:25.597 +0000 INFO TailReader [3323 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log' 05-05-2022 11:03:30.890 +0000 INFO AutoLoadBalancedConnectionStrategy [3316 TcpOutEloop] - After randomization, current is first in the list. Swapping with last item 05-05-2022 11:03:30.891 +0000 INFO AutoLoadBalancedConnectionStrategy [3316 TcpOutEloop] - Connected to idx=172.31.21.254:9997, pset=0, reuse=1. 05-05-2022 11:03:55.596 +0000 INFO TailReader [3323 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log' 05-05-2022 11:04:00.813 +0000 INFO AutoLoadBalancedConnectionStrategy [3316 TcpOutEloop] - Connected to idx=172.31.18.160:9997, pset=0, reuse=0. using ACK. 05-05-2022 11:04:11.124 +0000 INFO HttpPubSubConnection [3276 HttpClientPollingThread_71E59550-AD46-4814-8460-DB66C1DD0BAD] - Running phone uri=/services/broker/phonehome/connection_172.31.28.182_8089_ip-172-31-28-182.ec2.internal_uf01_71E59550-AD46-4814-8460-DB66C1DD0BAD 05-05-2022 11:04:25.596 +0000 INFO TailReader [3323 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log' 05-05-2022 11:04:30.704 +0000 INFO AutoLoadBalancedConnectionStrategy [3316 TcpOutEloop] - Connected to idx=172.31.22.208:9997, pset=0, reuse=0. using ACK. 05-05-2022 11:04:55.596 +0000 INFO TailReader [3323 tailreader0] - Batch input finished reading file='/opt/splunkforwarder/var/spool/splunk/tracker.log' 05-05-2022 11:05:00.613 +0000 INFO AutoLoadBalancedConnectionStrategy [3316 TcpOutEloop] - Connected to idx=172.31.18.160:9997, pset=0, reuse=1. 05-05-2022 11:05:11.129 +0000 INFO HttpPubSubConnection [3276 HttpClientPollingThread_71E59550-AD46-4814-8460-DB66C1DD0BAD] - Running phone  Any idea on solution to this ?  

The csv files are getting forwarded from a linux UF agent to splunk as and when it is created ie. 2:50 CET time. For a file getting created at 2:50 CET time on the same uf agent is not reflecting  in the splunk. The inputs.conf file of the app is not having any intervals configured.