Hello, i am trying to understand the documentation surrounding SHOULD_LINEMERGE. It says the default is SHOULD_LINEMERGE = true and BREAK_ONLY_BEFORE_DATE = true. If my understanding is correct this means that if a logfile has multiple lines, the multiple lines will be part of one event that is indexed up until the next date/timestamp is found and then that would be another event. I have a logfile with the following two lines: 2019-12-30 09:16:41:908: Requestor: IMM_Mobile, IsLocal: False 2019-12-30 09:16:41:908: 637132942019089151: Scanned CID: BARCODE: However, they get indexed as one event and this is not what I want. A previous suggestion to me was to make SHOULD_LINEMERGE = false, however I do not think I want to do that because there are certain entries in the logfile that do span multiple lines. Any assistance is greatly appreciated! David ... View more

Hello, When I view the deployment clients under forwarder management, not all my clients are being displayed. Every time I add a client, I can see that the client indeed does download the apps but is not displayed as a client. Currently the deployment server lists 40 clients. And every time I add a client it just stays at 40. Any help is appreciated. David ... View more

Hello, I have my props/transforms setup so that it routes data to specific indexes (For the most part) based on hostname. This was working great until I realized that it was also including data that was meant for internal indexes like _internal. Specifically for splunkd sourcetype. This was making my license utilize way more data than it should have been. So I added a prop for [splunkd] sourcetype to route data to _internal. This is now working for alot of my hosts but for some reason there are still 4 indexes receiving data that should be routed to _internal, they are indexes named mhh, irw, lvn, lee. Any help is much appreciated. Props and transforms below: PROPS: [HawkeyeIOLS] TRANSFORMS-set= setnull,setparsing SEDCMD-DOB = s#DOB/\d{8}#DOB/[REDACTED]#g SEDCMD-SEX = s#SEX/.#SEX/[REDACTED]#g SEDCMD-RAC = s#RAC/.#RAC/[REDACTED]#g [splunkd] TRANSFORMS-set_index_internal = set_index_internal priority=10 [host::(5050-LANE|5050-RGWS)] TRANSFORMS-set_index_5050 = set_index_bel [host::irw*] TRANSFORMS-set_index_irw = set_index_irw [host::mhh*] TRANSFORMS-set_index_mhh = set_index_mhh [host::mcn*] TRANSFORMS-set_index_mcn = set_index_mcn [host::lee*] TRANSFORMS-set_index_lee = set_index_lee [host::lvn*] TRANSFORMS-set_index_lvn = set_index_lvn [host::riv*] TRANSFORMS-set_index_riv = set_index_riv [host::con*] TRANSFORMS-set_index_con = set_index_con [host::ann*] TRANSFORMS-set_index_ann = set_index_ann [host::bel*] TRANSFORMS-set_index_bel = set_index_bel [host::apg*] TRANSFORMS-set_index_apg = set_index_apg [host::hol*] TRANSFORMS-set_index_hol = set_index_hol TRANSFORMS: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = \b(?:offline|online|HTTP 502 Bad Gateway|CheckUpdate: Error)\b DEST_KEY = queue FORMAT = indexQueue [set_index_internal] REGEX = . DEST_KEY = _MetaData:Index FORMAT = _internal [set_index_con] REGEX = . DEST_KEY = _MetaData:Index FORMAT = motco [set_index_ann] REGEX = . DEST_KEY = _MetaData:Index FORMAT = ANN [set_index_bel] REGEX = . DEST_KEY = _MetaData:Index FORMAT = BEL [set_index_apg] REGEX = . DEST_KEY = _MetaData:Index FORMAT = APG [set_index_hol] REGEX = . DEST_KEY = _MetaData:Index FORMAT = HOL [set_index_irw] REGEX = . DEST_KEY = _MetaData:Index FORMAT = IRW [set_index_mhh] REGEX = . DEST_KEY = _MetaData:Index FORMAT = mhh [set_index_mcn] REGEX = . DEST_KEY = _MetaData:Index FORMAT = mcn [set_index_lee] REGEX = . DEST_KEY = _MetaData:Index FORMAT = lee [set_index_lvn] REGEX = . DEST_KEY = _MetaData:Index FORMAT = lvn [set_index_riv] REGEX = . DEST_KEY = _MetaData:Index FORMAT = riv ... View more

Hello, I am trying to implement setting a specific index based on part of the hostname. For ALL of my data that I index I would like the index to be the first three characters of the hostname. is it possible to make this global and not on a source/sourcetype basis? Any help is appreciated! Davis ... View more