You mean modifying _raw before it is being indexed? Or while searching? ... View more

Please share one full event here for further help. You can anonymize data as needed, but please maintain the format of the event. ... View more

TIME_PREFIX=timestamp:\s TIME_FORMAT=%s should extract the timestamp properly ... View more

(Saved) searches are initiated on the Search Head;  you should find it there. You can also see the settings in effect in the UI under Settings->Searches, reports, and alerts if you select "Advanced Edit" from the dropdown for the relevant alerting search:   ... View more

I recommend never putting anything under system/local that doesn't need to be there, because those settings will be out of reach for the deployment server/client. Best practice is to create your org's configuration in apps in a meaningful way and assign those apps to the systems that need it. For example, you'd have a org_fwdr_outputs app that contains all conf files needed for data forwarding to indexers and map that to all your endpoint hosts. You could similarily create an app for your JBoss logs, e.g. org_jboss_logs or sth like that and deploy that to hosts that run JBoss. It is very worthwhile spending some time thinking about groups of things to simplify your serverclass.conf file such that you don't end up with an unmanageable mayhem of host groups and apps. Every app can have it's own set of conf files that will override the system defaults. I strongly recommend studying this part of the documentation until you fully understand how the this conf system works. HTH! ... View more

Have you tried to see what error messages are logged by splunkd in _internal when you try to save? ... View more

TIME_FORMAT=%s is the proper way to configure a timestamp in epoch format. If your logs are formatted such that Splunk cannot clearly identify which 10-digit value represents a timestamp, you may need to provide more hints (recommended to be explicit anyways), like TIME_PREFIX, MAX_TIMESTAMP_LOOKAHEAD etc. If you are able to provide a sample log event, it will be easier to help with more details. ... View more

I am not sure I understand what you mean by "not showing up on the deployment server". If you do not set clientName in deploymentclient.conf, the deployment client(s) should show up on the DS with its/their GUID value as the Client Name. I am not sure which environment variables are available and will be properly substituted by the deployment client code when processing the .conf file.  You should try to ensure the clientName ends up being unique; otherwise some of the forwarder management dashboards on the deployment server will not display accurate information (like distinct counts, etc.) ... View more

A timestamp in a global context isn't complete without a timezone reference. You can get away without specifying any timezones if you ensure all your systems are set to log in the same timezone (e.g. UTC), which is what a lot of organizations do. In the absence of this, either timestamps need to have an embedded timezone offset, or you can explicitly set the timezone a timestamp was generated in when configuring your sources.    Not having timestamps properly represented can cause issues with indexing (out of order events) and search (time-based correlation), so you want to make sure that every timestamp has a timezone context.  Alternatively, you may choose to simply use the time an event was indexed as the event timestamp.  ... View more

The clientName attribute in deploymentclient.conf is used solely for the purposes of matching a deployment client to a serverclass entry. You can name that whatever you like to distinguish groups of hosts instead of relying on the hostname.  To distinguish the events during search, your approach of explicitly setting the host to a unique value as you described will work. ... View more

Please consult the documentation here and the linked information at the bottom of the page to understand how Splunk assigns timezones if the event timestamp in itself does not contain a TZ qualifier. You would need to at least know what the source logs' timezone is to properly configure things... ... View more

Just remove the host=xyz from the tstats and add it to the by clause, i.e. by _time, host. And yes, the count is the number of events received by host. If you want the number of unique file sources, do a count by source (which is the filename, if it was a monitored file). ... View more

You should be able to remove these zombies by rebuilding the forwarder assets lookup:    Monitoring Console -> Settings -> Forwarder Monitoring Setup -> Rebuild forwarder assets     If you want to disable the alerts completely, read up here.  ... View more

If you have a recently provisioned SplunkCloud stack, you have a HEC address provisioned and enabled for you already. Your target HEC URL should be  http-inputs-{yourstackname}.splunkcloud.com You will find more documentation here.  You should be able to send HEC traffic directly to this VIP address. If this doesn't work, please open a case with Splunk support. ... View more

You are asking about CPU utilization, but your search query is using memUsedPct (memory)....? ... View more

Take a look here for some options to solve this. ... View more

You probably want parenthesis in there: index=abc ns=sidh-datagraph3 ("NullPointerException" OR "IllegalStateException") ... View more

Not sure I really understand your question. Cisco ASA is a security appliance, so the data you see in Splunk with this sourcetype usually comes in via TCP from those devices. Splunk has a TA for that with documentation. But I am really not sure if that's what you are asking about. ... View more