Hi Adonio, thank you for the reaction. The props.conf and the transforms.conf should be defined on the FW or on the Splunk Server site? ... View more

I tried to import the file manualy. I created my own sourcetype and added the parameter PREAMBLE_REGEX. It has no influence on the previewed content of indexed csv file. Even I tried simple regular expressions. The question is, if the parameter PREAMBLE_REGEX is either working properly. ... View more

I can create 2 very similar regex. 1. regex with 2 captured groups, which should be indexed .+\n(.+\n).+\n.+\n.+\n.+\n(.+\n) 2. regex with 2 captured groups, which should be ignored (.+\n).+\n(.+\n.+\n.+\n.+\n).+\n I have probably 2 possible choises. preamble_regex: the question is, if it is possible to put here regex #2, and if the captured groups will be accepted transforms.conf and parsing [stanza]: [setparsing] REGEX = regex #1 DEST_KEY = queue FORMAT = indexQueue the same question, if I use regex #1, if the captured groups will be accepted ... View more

Hi Andrew, many greetings. We were colleagues and shared Splunk informations a lot. I have very similar problem as you have described. Did you solve your problem in the mean time? I wish you all the best. Michal Spisiak ... View more

I also reduced the set of events: index=ind fail ... View more

Unfortunatelly it is impossible to submit the code. Nothing happened, although I pasted the code through 101010 and tried to submit it. ... View more

I removed ?. The previous rex has 2568 steps. The new one has only 70 steps. But the error message still appears. | rex "(?ms)<test\s+[^>]+^\s</test>" ... View more

As I thought, the non complete xml code has been pasted. Please, compare it with the uploaded regex-prob.jpg file. ... View more

Hi harsmarvania57, I try to paste the xml data here, but I'm affraid, that special chars will be removed: <subTest name="subTest_name" testPosition="unknown"> <subPositions> <subPosition name="{60}"/> <subPosition name="{59}"/> </subPositions> <subTestResult testResultClass="fail" testResultCode="failed"> <channel UnitOfMeasure="V" measureDataType="metricPrefix" name="channel_1"> <sample value="17.4375m"/> <limit_hh value="100m"/> <limit_h value="100m"/> <limit_l value="-100m"/> <limit_ll value="-100m"/> </channel> </subTestResult> </subTest> <subTest name="subTest_name" testPosition="unknown"> <subPositions> <subPosition name="{104}"/> <subPosition name="{47}"/> </subPositions> <subTestResult testResultClass="fail" testResultCode="failed"> <channel UnitOfMeasure="V" measureDataType="decimal" name="channel_2"> <sample value="1.89062"/> <limit_hh value="100"/> <limit_h value="100"/> <limit_l value="-100"/> <limit_ll value="-100"/> </channel> </subTestResult> </subTest> ... View more

Hi nareshinsvu, it is working. Thank you for the help. ... View more

Hi soutamo, thank you very much It is working already. Followed steps have been made: 1. Install, Open the app Config Explorer 2. On the initial page click on the button Settings. Change write_access = false to true. Right click, choose the Save file option. 3. Open appropriate inputs.conf, find the right monitor, add this: crcSalt = at the end of monitor. Save the file. 4. Restart the server. ... View more

Sorry, some special chars are not allowed in this chat. crcSalt = SOURCE ... View more

I have opened one nonindexed csv file in text editor. I added this string: crcSalt = to the header. After saving, the file has been automatically indexed in Splunk without any problem. ... View more

The name of the monitor is Files & directories. There is column Full path to you data in the list of all monitors. This column is probably the name of the monitor. Right? If yes, than my monitor name is the complet local path of the detected directory. My monitor detected all files in the directory. I can see the number of detected files in the list. When I create the monitor, I choose the csv sourcetype. I have defined index, which should be relevant to this monitor. Should be set any other properties, when I create the monitor? ... View more

Hi nareshinsvu, thank you for your message. I have no access to the file system of the server. It is possible to edit the inputs.conf via gui? ... View more

Hi aljohnson. I want to thank you very much for this solution. I applied it on my problem and it worked very well. Well done. ... View more

I tried to index the missing file separately with the same sourcetype in tmp index. It worked. I tried to change the content of the missing file in the monitored directory. The file became new timestamp and despite it, it has not been indexed. ... View more

Hi oscar84x, it was a mistake, that I though, it is time related. Each file has different timestamp of course. In 1 minute interval there are differencies on the sec level. The first line of each xml file is the same. The second line has some differencies and the rest of the content is total different. ... View more