yes, 7.2.1 is officially out yesterday(11/09),clicking on the message will direct you to Free Trails and Downloads page---->splunk enterprise(download free 60 day trial)------>download when you login If not you can download it from here(you can click on older releases if you need a different version) https://www.splunk.com/en_us/download/splunk-enterprise.html ... View more

I can see that message even after upgrading to 7.2.1, i think it's a default setting buried in that app configs. ... View more

I guess it should be enabled with props and transforms on the indexers in Splunk Cloud(may be a support ticket) https://www.youtube.com/watch?v=RJAaTyFHKeo&index=1&list=PL7zWAA-DF0k9xVLrl1j-lk2F74Ge3EgCZ ... View more

You can discard the data via nullQueue on your Intermediate/Heavy forwarder... http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad ... View more

I have already changed the regex, and i am checking on the right field extractions based on props and transforms. ... View more

1) Provide Vcenter details version : OS: Windows / Linux /.. it's a linux appliance vCSA 6.5 2) How you collecting VCenter vclog data on HF, Via monitoring stanza OR using syslog? vCenter--->syslog forwarding-udp/514(HF)-->using a monitoring stanza as defined above 3)Have you configured custom syslog or log files? I found above-defined extraction will work for only Syslog data. The rex used for sourcetype extraction will work for Syslog event only. we are thinking to do a custom extraction for sourcetype 4) Can you please check link and verify your steps? http://docs.splunk.com/Documentation/AddOns/released/VMW/vCenterlogs#Collect_vCenter_Server_Appliance_logs_via_syslog we are forwarding vCenter logs to HF, monitoring using a custom stanza, we haven't made any tweaks based on this doc. ... View more

I have the sample events below, but according to the docs, the props/transforms should extract these sourcetypes vmware:vclog:vpxd vmware:vclog:vpxd-profiler vmware:vclog:vpxd-alert vmware:vclog vmware:vclog:cim-diag Nov 13 09:28:33 vc-mir01 vpxd[2860] Event [5092318] [1-1] [2017-11-20T15:28:33.26976Z] [vim.event.UserLogoutSessionEvent] [info] [AD\irkms-sme-daleapp] [] [5092318] [User AD\itcms-sme-daleapp@192.168.90.89 logged out (login time: Monday, 13 November, 2017 15:28:21, number of API invocations: 1, user agent: web-client/6.5.0)] Nov 13 09:27:50 vc-mils vmon[1324] Executing op API_HEALTH on service netdumper... Nov 13 09:27:50 vc-mils vmon[1324] Constructed command: /usr/bin/python /usr/lib/vmware-vmon/vmonApiHealthCmd.py -n vmware-vpostgres -f /dev/shm/vmware-postgres-health-status.xml ... View more

Hi, we have upgraded vmware app to 3.4.0 and vmware is on 6.5.. we are forwarding vCenter logs to a HF which has Splunk_TA_vCenter, and we did make sure to change the inputs monitor path accordingly, but the regex in props and transforms is not extracting the sourcetype... #our custom inputs on HF inputs.conf [monitor:///var/log/vmware_hosts/vcenter-*.myorg/messages*] disabled = 0 sourcetype = vclog host_segment = 4 index = vmware-vclog #props and transforms are from Splunk_TA_vCenter props.conf [vclog] SHOULD_LINEMERGE = false TRANSFORMS-vmwvclogsourcetype = set_vclog_sourcetype transforms.conf #Sourcetype Extraction [set_vclog_sourcetype] REGEX = ^([a-z\-]+) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::vmware:vclog:$1 ... View more

Did you try with index and sourcetype in your search... index=_internal sourcetype=splunkd source=*metrics.log ... View more

An easy way should be searching the index and source with a future date-time range from your time range picker. ... View more

my original data is id=A123 clientid:123456 SSLR need to mask 123456 I used s/(clientid\W)(\d+)(\s\w\w\w\w)/$1masked$3/g you can try this.... "s/clientid:(\d+)/clientid:xxxxxx/g" OUTPUT : id=A128 clientid:xxxxxx SSLR "s/clientid\:(\d+)\s\S+/xxxxxx/g" OUTPUT : id=A128 xxxxxx ... View more

Is this the output you are expecting...?? id=A123 clientid:xxxxxx SSLR ... View more

This search works fine, i did some chart overlay with the total counts in my case. Thanks..!! ... View more

I am almost there, but index A,B Totals and Individuals hosts are on a single stack, is there any way i can do a different stacked columns for each IndexA Total with Individual host counts, Index B Total with individual host counts.? ... View more

This is what i did so far, where i can get the total count by category(index=a and index=b), but i am looking for if there's a way we can do individual counts within this search... your base search giving fields host, _time | ...some logic to get category field there... | bucket _time span=10m ***assuming you want to bucket time. update as required*** | stats count by _time group host | appendpipe [| stats sum(count) as count by _time group | eval group=group."- Total" ] | timechart span=10m sum(count) by group ... View more

yes, that works fine to get the individual count of the host in the stacked column, + i am also expecting to do a total count by index within the stacked column...?? ... View more

If I am not wrong, you can use a forwarder license on the HF and install the add-ons, as it does have the advancing parsing capabilities... http://docs.splunk.com/Documentation/SA-LdapSearch/2.1.4/User/Platformandhardwarerequirements ... View more

If you don't index the data locally on a HF....you can use a forwarder(1MB) license https://answers.splunk.com/answers/395082/do-we-need-a-license-for-heavy-forwarder.html ... View more

In your case...even DataCollections Nodes are supposed to be in a time sync with rest of the Splunk Instances...?? ... View more

I made this changes on the Search Head where the scheduler was running, i still see this job expirations on DCnodes when i looked at HydraFramework dashboard... 2017-05-09 10:59:51,007 ERROR [ta_vmware_collection_worker://eta:26954] [getJob] job=job_2016307834e011e7be7aecf4bbd1db64 of task=hostvmperf has expired and will not be run Do i need to make this changes on DCns too...?? ... View more