@gjanders  Thanks a lot. In terms of my testing, the LINE_BREAKER setting was applied by Indexer's default props.conf. So you are right. Line breaking has done by only indexer or heavy forwarder. BTW, in the case of EVENT_BREAKER setting on universal forwarder, it is only related to LB. I mean.. with EVENT_BREAKER setting, line breaking is not possible on forwarder. It have LB to determine if where is the event boundary. Even though EVENT_BREAKER is enabled on universal forwarder, LINE_BREAKER on Indexer would be applied. Is my understanding correct? I would greatly appreciated if you answer again. Thank you! ... View more

@gjanders  Thanks a lot. It helped a lot. In the diagram, there is a parsing pipeline on universal forwarder. Do you mean the parsing pipeline on universal forwarder do not do "event processing"? If yes, why does it name "parsing pipeline"?  It makes me confused. ... View more

@venkateshparankusam Hi, Thank you sooooo much for your response. The instances are not able to access remotely, so please let me check within a couple of days. I will let you know the result and accept your answer. Hope it would work. Thank you again. ... View more

@to4kawa Hello, Thanks, but it dose't work. xyseries also has limit for column number... ... View more

@DalJeanis Thank you for reply. I made a mistake. When I apply those configurations on Indexer, It is working as I intended. But I encountered another issue: I am not able to extract two field-value. Actually, my intention was to apply "log-to-metric" on unstructured data. The log below is just sample. 176.212.0.44 - - [29/Jan/2017:19:12:30] "POST /cart.do?action=purchase&itemId=EST-17&JSESSIONID=SD9SL8FF10ADFF5186 HTTP 1.1" 200 853 "http://www.buttercupgames.com/cart.do?action=addtocart&itemId=EST-17&categoryId=SPORTS&productId=CU-PG-G06" "Mozilla/5.0 (iPad; CPU OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3" 517 476.212.0.44 - - [29/Jan/2017:19:12:30] "POST /cart.do?action=purchase&itemId=EST-17&JSESSIONID=SD9SL8FF10ADFF5186 HTTP 1.1" 200 853 "http://www.buttercupgames.com/cart.do?action=addtocart&itemId=EST-17&categoryId=SPORTS&productId=CU-PG-G06" "Mozilla/5.0 (iPad; CPU OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3" 517 176.212.0.44 - - [29/Jan/2017:19:12:31] "POST /cart/success.do?JSESSIONID=SD9SL8FF10ADFF5186 HTTP 1.1" 200 2472 "http://www.buttercupgames.com/cart.do?action=purchase&itemId=EST-17" "Mozilla/5.0 (iPad; CPU OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3" 299 Let's say I want to extract 3 digit at the end of log and 3 digit at the beginning of the log (I know it does not make sense.) How can adjust conf files? I have searched and tried many times, but it seems impossible... Do you have any idea? ... View more

@DalJeanis Thanks. The default value of SOURCE_KEY is _raw so don't need to specify. METRIC_NAME FORMAT is correct because I intended to do hard-cording field name with "code", not extracting from the log. That's way I used the syntax. Thanks anyway. ... View more

Thanks a lot. ... View more

Did you resolve this issue? I have a same problem... ... View more

Hi, @Sukisen1981 Yes.. It was a long haul but it's worth. The answers for your questions are here: 1. web.conf + limits.conf + xml must be configured. These are necessary combination. 2. Of course I tested with _internal/_audit and my own logs. The reason it works with internal logs is because when the browser get data from splunk, it calls restapi. From web browser side, it doesn't matter if the logs are internals or externals. You must know how much I am happy! 🙂 Thank you for your help. Hope it helps. ... View more

Hi, @Sukisen1981 Now I've resolved it by myself. I was due to a maxresult value of restapi on limits.conf. Since I've changed it to 200000 (0 is not working), it works... [restapi] maxresultrows = 200000 Hope it would help others who have same problems. Thank you for your willingness to help me. Thanks again. ... View more

Hi, @Sukisen1981 Thank you so much. 1-2. I changed configurations as you suggested. 3. I try 7.2.6 & 7.3.1. Both fail. 4. Of course, I restarted and cleared browser cache... What's wrong... 😞 ... View more

HI, @niketnilay Thank you for your comment. Unfortunately, it doesn't work. I set Simple XML option, of course, and changed all relevant configurations on visualizations.conf, limit.conf, web.conf. I did test on 3 different versions and tried to figure out what's wrong. It's weird... Is it really working? ... View more