Hi! I checked the same code but it's giving the correct result. It's printing 2017-11-05 once and 2018-03-11 does exist. Thanks. ... View more

Hi, Can you please share sample logs? Also, if your rex is working fine then can you try adding max_match = 0 after the rex which will help you in looping through each attachment. ... View more

Hi @mmoermans, It's always recommended not to use wildcard in the monitor stanza if you really have less number of files to be monitored. Also, verify the below points- 1. Number of files that are getting monitored by the command ./splunk list monitor . 2. Size of the log files. 3. Proper parsing of the log files. 4. Check if any older files are being monitored and if so you can ignore those. I hope you would find something from checking the above listed points. Thanks. ... View more

Hi @raomu, You can keep the configuration DATETIME_CONFIG = blank in props.conf instead of setting it to CURRENT or NONE that will consider the timestamp of the event. For your reference https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Propsconf Thanks. Let me know if that helps. ... View more

Hi, If you have used crcSalt = <SOURCE> from your inputs.conf then you should remove that if you your files get rotated after a certain time duration. Setting crcSalt in such case will cause re-indexing of your data. Thanks! ... View more

Hi, do you have a single source from where data is coming or multiple sources? ... View more

Hi Shraddha, I believe you have might pushed the bundle to the cluster through the deployer and you have created your roles locally on your search head. If so, then its high chance that your locally done things have been overwritten with the upgrade that you just did. Regarding the recovery, I don't think there's a way unless you have back up. Thanks! ... View more

Hi @wegscd! It affects parsing. ... View more

Please set CHARSET = AUTO in your props.conf ... View more

Yes, you should try the 2nd search, set the alert and check. ... View more

Hi!! Kindly refer to the link below: https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Configurecharactersetencoding ... View more

Can you mention the search and the alert conditions you have configured, so that it's easier to find the solution. ... View more

Hi! Can you please modify your cron expression with 0 */4 * * * and check if that's working? ... View more

Hi, may I know why are you creating the files in your splunkforwarder? ... View more

Hi! Follow the below steps for the single instance: Create your script in /opt/splunk/etc/apps/search/bin/ Create your inputs.conf in /opt/splunk/etc/apps/search/local/ Create your indexes.conf in /opt/splunk/etc/apps/search/local/ Follow the below steps for clustered set up: Create your script in /opt/splunk/etc/deployment-apps/<yourappname>/bin/ Create your inputs.conf in /opt/splunk/etc/deployment-apps/<yourappname>/local/ Create your indexes.conf in /opt/splunk/etc/master-apps/<yourappname>/local/ Do let me know if that's working for you. Thanks! ... View more

Hi, you can create the index with the below stanza: [yourindexname] coldPath = $SPLUNK_DB/yourindexname/colddb enableDataIntegrityControl = 0 enableTsidxReduction = 0 homePath = $SPLUNK_DB/yourindexname/db maxTotalDataSizeMB = 512000 thawedPath = $SPLUNK_DB/yourindexname/thaweddb If this is a single instance setup then you can place your indexes.conf stanza in /opt/splunk/etc/apps/search/local and in case of clustered environment you can place the indexes.conf file inside /opt/splunk/etc/master-apps//local ... View more

Sure! You first create a script which is going to check the jboss status of your machines. You can refer to sample scripts in the below link which will check the jboss status. https://stackoverflow.com/questions/8761374/how-to-check-if-jboss-is-running-on-unix-server Save the script in the bin directory of your app and then create an index like you create index normally which will store the result of your script. Then create the inputs.conf in the local directory of your app and give the path to your script. This complete thing is going to index the output of your script. Post the indexing you can set up alerts which will be triggered once it finds "jboss is not running" in your events. I hope this sounds clear. Do let me know if you find any trouble in doing that. Thanks!! ... View more

Hi, Do you have permission to export? Also, which browser are you using? I'm also running Splunk 7.0 and the export PDF is working fine for me. Thanks. ... View more

Hi @kranthik, can you be more clear with the requirement so that it's easier to suggest solutions? ... View more

Hi @shakeel253, You can run a script which will check the jboss status on the machines and index the output of the command in Splunk. Then you can set up an alert on when you get the status as "jboss is not running". Thanks! ... View more

Hi @Motoko89, Can you please confirm, if you have non- clustered environment, how do you get data in your system for indexing? I'm assuming that you are seeing just one third of the license usage because you might be getting data in through only one of your indexers. ... View more

Hi! You can add the below configuration parameters in your limits.conf file of your app. [kv] limit = maxcols = The default values for limit is 100 and maxcols is 512. You should try indexing your csv by increasing the default values. Link for your reference. https://docs.splunk.com/Documentation/Splunk/7.0.1/Admin/Limitsconf Thanks. ... View more

Hi!! Can you check your monitoring console to find your indexer clustering status and "Indexer Clustering:Service Activity" for any warning or error over the time? Also, make sure you get your indexers listed in the peers in the indexer clustering. ... View more

Hi! Though not recommended but you can make your deployment server as master node for indexer clustering as long as you meet the minimum hardware configuration wherein the forwarder management will take care of the forwarders and the indexer clustering will manage the clustered indexers. Thanks. ... View more

Hi @akocak! You can try adding alerts to the navigation menu. Yo can create different alert tab for different teams which may or may not have same alerts and give the permissions accordingly. Find the below link for more details: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEP9 I hope this can help you to solve your first point. Regarding the second point, you will have to manually add the alert to the respective navigation menu or you can try to save the alerts in different apps. While saving the alerts you can select the specific app you want to save the alert to and give the user permission of that app specifically. Thank You! ... View more