Hey, If there's a timezone in the timestamp, it will override whatever is being set in TZ. Therefore, you have two options: - Manually configure the timestamp recognition, and do NOT include the timezone part in the TIME_FORMAT setting, so it should work with your example and %Y/%m/%d %H:%M:%S - If this is syslog, you can have that log timestamp just being rewritten with a proper timestamp, and let Splunk just do it's thing. I've done it with syslog-ng before, you can read about it here: https://spice.areafunky.net/2017/07/08/bye-rsyslogd-here-comes-syslog-ng-fixing-timestamps-without-timezones/ Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Hey, This obviously seems to be an syslog issue rather than a Splunk issue. Two approaches: use tcpdump to verify that data is actually received by your server, e.g. tcpdump -i eth0 udp port 2500 , then send something and check if tcpdump looks fine (post it here if in doubt) syslog-ng has proven to be easier to configure and to debug, so you might think about switching to it if you're just getting started with your syslog setup. Hope that helps! ... View more

Try removing that global whitelist, and see if it works than (might require reload/restart) ... View more

It's basically: Splunk is not running as root (which is good), but you're logged in as root (which is not so good). When you try to login (which is required to reload the deployment server), Splunk saves your login (which would be a cookie if you we're using a browser) in a folder in your home directory (/root/.splunk/). But as Splunk does not run as root, it has no permissions to do that, therefore the error message. Solution: Do not work as root, especially not while editing files on a non-root Splunk, it will bring you into trouble. I'd suggest using a normal user, you could use the user Splunk is running at. Hope that helps! ... View more

Hey, try this please for your transforms.conf: SOURCE_KEY = MetaData:Source REGEX = yourregex WRITE_META = true You can find more information on how to extract index time fields here: http://docs.splunk.com/Documentation/Splunk/7.1.0/Data/Configureindex-timefieldextraction For metrics data, you can completely ignore anything written that relating to fields.conf. ... View more

I'm pretty sure thats not the right way, although it would technically be possible. However, there is a good approach to this - the free Splunk 50GB license for test and dev environments: https://www.splunk.com/en_us/resources/personalized-dev-test-licenses.html Hope that helps! ... View more

Hey, This looks like the perfect use case for coalesce() : | eval Method=coalesce(Method, Action) Read up on its details here: http://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/ConditionalFunctions ... View more