Hi All, I have some question on the regular expression extraction they can be added in props.conf Supposing I have indexed in Splunk files with multiple lines that at a certain (not fixed) point have the following pattern, and I have to extract the "nameoftheuser" and the "nameofthejob" = USER : nameoftheuser AAA = JOB : nameofthejob I know I can do that in this way: EXTRACT-USER = ^(?m)= USER : (?P<USER>\w+) EXTRACT-JOB = ^(?m)= USER : \w+ AAA = JOB : (?P<JOB>\w+) or even in that way: EXTRACT-USER,JOB = ^(?m)= USER : (?P<USER>\w+) AAA = JOB : (?P<JOB>\w+) My first question is, referring to props.conf documentation: considering that EXTRACT-USER is the <class> and (?P<USER>\w+) is the <regex> the field will be stored in the class or in the regex? Just to be more clear: EXTRACT-TEST1,TEST2 = ^(?m)= USER : (?P<USER>\w+) AAA = JOB : (?P<JOB>\w+) at search time USER and JOB values will be stored in TEST1 and TEST2 variables or in USER and JOB variables? Second question, I do not understand what exactly is indicated here in props.conf documentation: Use '<regex> in <src_field>' to match the regex against the values of a specific field. Otherwise it just matches against _raw (all raw event data). I understand it is an advice to improve the performance of the field extraction, but I do not get exactly how to take advantage of it...Does someone can explain it to me? Thanks a lot, Edoardo ... View more

Hi All, I have to monitor a folder where there are very huge files with file name automatically generated. Is there some way (instead of write a custom UNIX script that moves only small files to another folder that will be then monitored by the forwarder) to blacklist files that have a size greater than (suppose) 10 MB? Any other suggestion with Splunk stanza attributes is appreciated. Thanks a lot, Edoardo ... View more

Hi All, We would like to know if it is possible to embed a splunk spl search into a javascript. If yes can you please provide some example? Thanks a lot, Edoardo ... View more

Hi All, Is there a way in ITSI to click on a saved GalssTable and have it open at a fixed percetange (suppose 20%) instead of having it always open at 100%? Thanks a lot, Edoardo ... View more

Hi All, We started ingesting in Splunk data generated from a custom UNIX script that runs every 5 minutes. The output file of the script is overwritten every run, and the dimension is around 20KB. In Splunk we have set-up to monitor the output file, and for approximately half a day everything worked properly. The day after we have seen nothing was indexing anymore, so we have checked in the _internal index and in splunkd.log and found the following information: 03-02-2018 10:03:35.168 +0000 INFO TailingProcessor - Parsing configuration stanza: monitor:///test/test_file.fwd. 03-02-2018 10:05:33.995 +0000 INFO WatchedFile - Will begin reading at offset=0 for file='/test/test_file.fwd'. 03-02-2018 10:10:12.045 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/test/test_file.fwd'. 03-02-2018 10:15:11.472 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/test/test_file.fwd'. 03-02-2018 10:20:11.968 +0000 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/test/test_file.fwd'. Do you know why Splunk is not indexing anymore that file? Thanks a lot, Edoardo ... View more