@montgomeryam I could not figure this out on the splunk side. But if you contact your windows admin, there is place where you can uncheck check-boxes to exclude cs-cookie and other fields from logging. So there is no data for splunk to pick up. ... View more

this did the trick!! wonderful ... View more

@flegel2 I fixed it by placing the ASCII value of ? in the query. Its ASCII value is %3F ... View more

I am having the same exact issue. transforms.conf [props1_props_tr] DELIMS = "," FIELDS = field_1,field_2, field_3,field_4 props.conf [props1_props_props2] REPORT-props1_props = props1_props_tr both the props.conf and transforms.conf reside in apps/search/local/ I have selected "ALL" but the transforms does not show up in the "Field transformation" page on splunk web. We have a search head cluster implementation. Could this behavior be due to cluster? The permissions on my props --> props1_props_props2 is "Global", if that helps. Is there a solution to this? ... View more

@jconger-- The link you provided has a disclaimer at the top: This feature has been deprecated as of Splunk Enterprise version 5.0. This means that although it continues to function in version 6.x of Splunk software, it might be removed in a future version. ... View more

Hi Michael, I see the new version of this add-on was released on Oct13 viz. 4.1.1. Have you upgraded to new version of this add-on? If yes, is the regex working in new version? I do not see any release notes for the new version of add-on, so in a dark here on what was fixed and what not. https://answers.splunk.com/answers/473926/after-upgrading-the-splunk-add-on-for-amazon-web-s.html ... View more

@montgomeryam: I had windows admin take care of it. There is a screen available where you can configure IIS logs and filter (through checkbox) its various components. So just filter it out on the windows level and splunk does not ever see them. ... View more

Does anyone has any thoughts on this? ... View more

Thanks Martin, I had exactly the same issue as bbhandari012. I went by your recommendation for creating a separate app and build navigation from it. ... View more

I have a similar question too. I have multiple log groups like: /aws/sample/Pattern1-random1-random2 /aws/sample/Pattern1-random3-random4 /aws/sample/Pattern1-random5-random6-random7 How do I specify a regular expression in "Log Group" Name that satisfies all these? I have tried /aws/sample/Pattern1* , /aws/sample/Pattern1[-A-Za-z]+ and a bunch of others. But I receive this error: {u'message': u"2 validation errors detected: Value '' at 'logGroupName' failed to satisfy constraint: Member must have length greater than or equal to 1; Value '' at 'logGroupName' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\.\\-_/#A-Za-z0-9]+", u'__type': u'InvalidParameterException'} ... View more

I also had same issue while upgrading ES from 3.3 to 4.1. ./splunk search '| testessinstall' worked for me. Awesome and thanks for the workaround. ... View more

I retyped my password and the error went away. Thanks for your tip. ... View more

Does anyone else face the same issue? Will someone care to answer my question? ... View more

After grouping the fields into one list, how do I make this list comma separated? ... View more

Hi HattrickNZ and mjm295, Wildcard does not work with case as expected. small trick is to use match within the case. Check the answer here: https://answers.splunk.com/answers/55524/eval-wildcards.html ... View more

Hi Guys, Any further thought on this? Its hard to believe that setting a field to null is so difficult in splunk. ... View more

Hi Amrit, REGEX=(.) has made the WARN disappear, but cs_cookie field is still not getting filtered (or is not being set to null) ... View more

I tried this config but it gives the below warning on the UF internal logs: WARN regexExtractionProcessor - Too few groups in regex: setnull-cs_Cookie; captures: 0, args: 1 And the filtering of cs_cookie still fails. Below are my two files: props.conf [iis] TRANSFORMS-set=setnull-cs_Cookie transforms.conf [setnull-cs_Cookie] SOURCE_KEY=field:cs_Cookie REGEX=. FORMAT= ... View more

Hi Amrit, Your example is good but i have another use case. I want the entire field=bar not to be indexed. Specifically for IIS logs, i want the field cs_cookie to be not indexing and in hope of achieving this on the UF level. Any ideas on what the props/transforms configuration will be? ... View more

My employees and contractors resided in different OU. So it worked for me after expanding my userbaseDN to include OU=contractor. I have a multiple LDAP strategies though, because we have users connecting from across the globe (UK/DE/Japan) to one search head instance. and each of these global regions have their own DCs and userbase. ... View more

I have the same exact issue. The employees show up fine, but not the contractors. ... View more

I ran the script and returncode=1 ... View more

Thanks. this worked for me too like a charm. ... View more

This is the error. msg="A script exited abnormally" input="./bin/rlog.sh" stanza="default" status="exited with code 1" I thought the solution you provided will make these messages go away. But since the rlog.sh is scheduled to kick-off every hour, these messages/error appear houlry on the Splunk search web User Interface. ... View more