There is following description in this manual. For example, say you're performing a simple <field>::1234 extraction at index time. This could work, but you would have problems if you also implement a search-time field extraction based on a regex like A(\d+)B, where the string A1234B yields a value for that field of 1234. This would turn up events for 1234 at search time that Splunk would be unable to locate at index time with the <field>::1234 extraction. I don't feel that Splunk is completely a "schema on the fly" in this specification... Is this specification never modified? I hope that it will be changed. ... View more

My environment: Splunk Ver 7.2.3 UF Ver 7.2.3 UF monitors var/log/messages , and forward it to Splunk. But after log rotation at 02-01-2019 00:05:00 , UF no longer forward it. In internal log, there is message like below. 02-01-2019 00:05:07.503 +0900 ERROR TailReader - File will not be read, is too small to match seekptr checksum (file=/var/log/messages). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info. But I wonder whether there is a possibility that the rotated file will be the same as the first 256 bytes of the already loaded file (the file one generation ago). Also another weird thing is that there is a message that begins reading the file as follows just before crc error, and the only first 20 lines from the beginning of the rotated file have been indexed in Splunk. 02-01-2019 00:05:04.500 +0900 INFO WatchedFile - Logfile truncated while open, original pathname file='/var/log/messages', will begin reading from start. I can't solve it by myself... If somebody knows about it, tell me... ... View more

My environment: UF ver 7.2.3 on windows Indexer ver 7.2.3 on Linux My UF is monitoring log that has second header line in middle of log like below. * I don't know why, but this is specifications of certain product... *This log is not CSV , also not any kind of structered data. time message 2019/02/05 10:00:00 this is test 2019/02/05 11:00:00 this is test 2019/02/05 12:00:00 this is test time message 2019/02/05 13:00:00 this is test 2019/02/05 14:00:00 this is test I was thinking to avoid first header line by below settings, and ignore second header line. Indexer's props.conf [test] DATETIME_CONFIG = SHOULD_LINEMERGE = false TIME_FORMAT = %Y/%m/%d %H:%M:%S TZ = Asia/Tokyo category = Custom disabled = false pulldown_type = true LINE_BREAKER = ([\r\n]+) UF's props.conf [test] CHARSET = UTF-8 NO_BINARY_CHECK = true disabled = false HEADER_FIELD_LINE_NUMBER = 2 But one event above second header line was merged with header line like below capture. Anyway, I added SHOULD_LINEMERGE = false to UF's props.conf , then it was solved. But I can't understand how it works! I think that I have to configure SHOULD_LINEMERGE = false to props.conf of Indexer or HF, but is it wrong? Is there some situation that I have to configure it to props.conf of UF? Please someone tell me about it. ... View more

I know that how to calculate max search concurrency in stand-alone is below. normal search : max_hist_searches = max_search_per_cpu(* default is 1) * core + base_max_searches(* default is 6) normal real-time search : max_realtime_searches = max_rt_search_multiplier(* default is 1) * max_hist_searches saved search : max_hist_scheduled_searches = max_searches_perc(* default is 50)/100 * max_hist_searches saved real-time search : max_realtime_scheduled_searches = max_searches_perc(* default is 50)/100 * max_realtime_searches But if there is an environment such as below, how would I calculate? Search head : 3 (* contains captain) Indexer : 4 (* not contains Cluster master) Please someone tell me. Also if there is document that mentions about it, please tell me too. ... View more

My environment : Splunk Stand-Alone ver 7.2.3 I'd like to extract username that match with lookup case-insensitively, also I want to extract username that match with lookup using WILDCARD. But in 7.2.3, I can't realize it. * Although in 7.1.4, I can. The settings and search used for verification are as follows. transforms.conf [test_case_insensitive] batch_index_query = 0 case_sensitive_match = 0 filename = test_case_insensitive.csv match_type = WILDCARD(status) Lookup table : test_case_insensitive.csv status,status2 "*AAAAA*","OK!" Example search | makeresults count=3 | streamstats count as c | eval status=case(c=1, "###AAAAA###", c=2, "###aaaaa###", c=3, "###AAaaa###") | lookup test_case_insensitive status OUTPUT status2 Is this a bug? If someone know about it, please tell me, also give me workaround. ... View more

UF : 6.4.5 Deployment-server : 6.6.11 If I execute this in UF, it is no problem. /opt/splunkforwarder/bin/splunk display app -uri https://<deployment-server's ip address>:8089 -auth <user>:<pw> But if I execute this in deployment-server, below error is displayed. /opt/splunk/bin/splunk display app -uri https://<UF's ip address>:8089 -auth <user>:<pw> Error message : Couldn't complete HTTP request: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure I thought it is ssl issue, so I configured server.conf in deployment-server like below, but it is still not working... [sslConfig] sslVersions = *,-ssl2 sslVersionsForClient = *,-ssl2 cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH https://docs.splunk.com/Documentation/Splunk/6.6.11/ReleaseNotes/KnownIssues https://docs.splunk.com/Documentation/Forwarder/6.6.11/Forwarder/Compatibilitybetweenforwardersandindexers How can I solve it? Please someone help me. ... View more