I'll try to continue here as my troubles didn't finish yet. So I need to remove those square brackets and let Splunk recognize this type like a usual JSON ({.....}). I've applied transforms like this: [jsontest_null] REGEX = ^([|)([^]$]+)(]|$) FORMAT = $2 DEST_KEY = _raw But even with this the events still get reindexed with adding new records to the file. Is there any way to escape this? My props.conf: LINE_BREAKER = (,)({"action") AUTO_KV_JSON = true SHOULD_LINEMERGE = false Sample fake events (always separated by comma): [{"action":{"date":"2017-03-27T07:56:14","name":"open","host":"host1","user":{"id":"27","name":"Doe, Joe","class":"5"},"obj":{"file":"3","name":"3","version":"1","size":"2963","type":"1","room":{"name":"room1","id":"room1"},"subject":"m5","fab":"a1","dir":"m5-a2"}}},{"action":{"date":"2017-03-27T07:56:15","name":"open","host":"host2","user":{"id":"27","name":"Doe, Joe","class":"6"},"obj":{"file":"3","name":"3","version":"1","size":"2433","type":"2","room":{"name":"room1","id":"room1"},"subject":"m5","fab":"a1","dir":"m5-a2"}}}] ... View more

The same on Linux. ... View more

windows 10 ... View more

The same, actually I've added followTail=1 with hope this will resolve it. ... View more

sure: [monitor://mypath*.json] disabled = 0 host = myhost sourcetype = my_json_test1 source = my_json_test1 index = my_json_test1 alwaysOpenFile = 1 followTail=1 ... View more

No, it's more - each event has approx. 400 chars ... View more

Hi, strange , but host_segment doesn't work from inputs.conf neither... Strictly declared host ( host=mydevicename ) works fine. ... View more

Hi, Here's my stanzas. Sorry, but I have to change names [monitor:///work/VENDOR_DEVICES_/mydevice.mydomain.com] disabled = false index = vendor source = vendor_model host_regex = .*DEVICES\_\/(?<host>\S[^\/]+).* The source value is unique for this type of devices Also I had to mention the folder structure inside each folder like the following: /work/VENDOR_DEVICES_/mydevice.mydomain.com/2016/2016-12/2016-12-28/mydevice.mydomain.com_20161228.txt ... View more

That's it! The "Maximum matches" was restricted to 1 (how could I miss this point) , thank you! ... View more

Thanks guys, need to show up what I need - multivalue field ip for my user : fullname ip John Doe 10.0.0.1 10.0.0.2 10.0.0.3 Jane Doe 10.4.1.1 10.4.1.3 I don't need bunit part in output ... View more

This is it, thank you! ... View more

Great, this approach works! I should examine search commands more diligently ) Great suggestion, Runals, I'll add this dropdown to my form. As for "Type search" - this is just for situations when user needs to add something to search directly in this view. Thank you! ... View more

Thanks guys, but... Let's say I have feeds from Inventory DB and I'd like to create view in Splunk where I can choose any category of assets (separate resulting csv tables, like inventory_pc, inventory_vm etc) and define some keyword and it will be looking for that word. Fields for each category have something different from other category - e.g. name of assets - 'PC Name', 'VM Name', 'Device Name', some categories have unique fields - you'll never know what to expect. Panel in my form should have unified search: | inputlookup $category$ | search $keyword$ $search$. How can I achieve this? ... View more

Nice, thank you! ... View more

Hi, do I understand correctly - if I have perpetual ES and perpetual Splunk Enterprise licensed and want to upgrade Splunk Enterprise - than I need also upgrade License ES to the same amount? ... View more

Hi, jcoates. Thank you for quick reply and suggestion, we will update ASAP. But I'm afraid there's something misconfigured or that I can configure so Splunk will not cut off last 3 symbols of original timestamp record. The events are indexing well, the problem it has wrong input for time. ... View more