How do you extract a timestamp from message having event1: Timestamp:2018-09-06T00:00:11.214000000, Timezone:UTC event2: Timestamp:2018-09-06T00:00:11.214, Timezone:CST where sub seconds can be milliseconds or nano seconds which vary and time zone can be any string like UTC,CST etc. ... View more

I have events which have timezone field whose values are UTC, America/chicago, etc. How can I map these timezones to standard time zone. I tried to use TZ_ALIAS, But string "America/Chicago" string should be mapped to CST/CDT based on daylight savings. Is there any possibility to handle such situations? ... View more

Splunk JMS app UI is basically showing to enter connection details for connecting solace queues. In case if I have to connect to MQ queue(where wee have host, serverchannel etc), May I know how to enter the values on UI. I tried to enter key value pairs in JNDI properties input box, but it is not working. It would be a great help. ... View more

Hi, When we restart splunk forwarder from deployment -server does it start 1) based on user defined in boot script OR 2) Based on the UserId under which is installed. Suppose Splunk is installed under user "splunk" and boot script is defined to start as root user. So when Splunk restarted by DS, does it run as root or splunk user . ... View more

For props.conf which has highest precedence. In documentation, they said [source::] settings override both [host::] and [] settings 1) if props.conf is in ..etc/system/local [sourcetype1] TIME_FORMAT=..... ... 2) And props.conf in etc/apps/app1/local/ [source::....] TIME_FORMAT=..... ... we know system/local has higher priority than app1/local.... But has high priority over Could you please let me know which TIME_FORMAT setting will be applied,. from system/local? OR App1/local? Conf. file location precedence is higher OR stanza type precedence is higher? ... View more

May I know whether .spec files used just for user information or they will also be used by Splunk processes? Having .spec file is mandatory for configuration file? ... View more

On the Splunk docs it is given as How Splunk Enterprise handles monitoring of files during restarts When the Splunk server is restarted, it continues processing files where it left off. It first checks for the file or directory specified in a monitor configuration. If the file or directory is not present on start, Splunk Enterprise checks for it every 24 hours from the time of the last restart. The monitor process scans subdirectories of monitored directories continuously Suppose if I deployed inputs to monitor a file and restarted splunk after deploying and If the monitored file was not created yet. Does splunk enterprise check for that file only after 24 hours to reads the file. What if the file created after few minutes after restart. Will it be ignored until 24 hrs of restart. Suppose I gave wildcard for file name, Does it behave same. I can see newly created file was read by splunk immediately when it created for wild card file names. ... View more

Hi, Splunk UF is setup to read files from particular directory. It reads files normally for few minutes, but suddenly it throws an error WARN FilesystemChangeWatcher - error reading directory "xxxx/xxxx/xxx": Permission denied Again when we reinstall splunk it reads normally and stops after few minutes showing permission denied. May I know, Is there any reason that it suddenly shows permission denied error after reading half of the file. Is there any possibility that when a file is written by some other process , It blocks other process to read the file? ... View more

Can we set frequency to fetch results from database to real time. Does that effect anything. Does Splunk take more space to index database inputs rather than regular raw data inputs. I assume so, because the field-values from database inputs seems to be indexed too. ... View more