Hi jmonreal, There are a few things here: Please do not make your configuration changes in /default. There is a good chance that if you upgrade, your configurations will be overwritten. Have you looked at using the "host" directive rather than using _meta? [udp://44444] disabled = false index = main source = docker sourcetype = docker host = registrydocker.localdomain.com _TCP_ROUTING = test _meta = site::"sao" environment::"_default" pool::"registrydocker" domain::"localdomain.com" cloud::"true" You can also add the "host" directive to your inputs.conf: [tcpout:test] server = 192.168.1.101:9997,192.168.1.100:9997 disabled = false host = registrydocker.localdomain.com If you are not seeing any of your _meta fields, you may also need to check your fields.conf. ... View more

One thing you may want to try doing is removing the "+" symbols from the user-agent string (some of the regexes in the YAML do use spaces). Something like: eval http_user_agent = replace(http_user_agent,"+"," ") If that doesn't work, then you may need to edit the regexes. This can be done by editing the regexes.yaml , but be aware that those changes may be overwritten on an upgrade. HTH, Dave ... View more

Here is a simple way to do this using props and transforms: For each host you would need a props.conf entry that calls a transform [host::10.0.0.1] TRANSFORMS-force_index = force_index, force_sourcetype Then in your transforms.conf : [force_index] REGEX = (.) DEST_KEY = _MetaData:Index FORMAT = indx1 [force_sourcetype] REGEX = (.) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::srctype1 These configurations would need to be placed on your first parsing system (first full instance of Splunk, like a heavy forwarder or indexers). HTH, Dave ... View more

Hey Ramesh, The field that you are performing the lookup on should be named http_user_agent. So you may need to add a rename to your search: index=node | rename userAgent AS http_user_agent | lookup user_agents http_user_agent HTH ... View more

Yes, it should. I have deployed it to an SHC without issue. ... View more

They aren't conflicting, but the second one could be a little clearer. The transforms are setting the queue, and the last one to run will win. That is, the setnull transform will match all events, and set them to the nullQueue. The second (setparsing) will then run, and set the queue to indexQueue. While the data is still raw (not cooked) you can still manipulate the queue, as shown in the docs. If the setnull were to run second, then all of the events would be sent to the nullQueue, which is not desired in this example. So, yes, they are run in the order of the list. ... View more