I'm wondering if there are other locations than inputs.conf, props.conf that a sourcetype might be named/assigned. I have data that's supposed to be marked with sysinfo_binfiles. When I search for t...
...plunk defaults to ignoring .bak files in a system props.conf file:
[source::...((.(bak|old))|,v|~|#)]
sourcetype = ignored_type
.... which corresponds to the following in the log:
08-23-2...
Here is my situation, we had a test installation of Splunk Enterprise 7.2.4 on Server1, with Universal Forwarders installed on Server2 & Server3, just generic Windows Servers. Events were arrivin...
...: The file access permissions do not allow the specified action.
tar: 0511-188 Cannot create splunkforwarder/etc/system/default/source-classifier.conf: The file access permissions do not allow the s...