Hi pfabrizi, on the server running the universal forwarder, enter this URI into a webbrowser: https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus username and password are the local Splunk universal forwarder ones (by default Splunk/changeme - or to whatever you did set it while install). Read more here : https://www.splunk.com/blog/2011/01/02/did-i-miss-christmas-2.html If the events are monitored, good. Login to your Splunk Web UI and run an all time search on index=wineventlog it maybe that the timestamp is not recognised. If so, read here http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition If the events are not being monitored by the universal forwarder it might be a permission issue on the Windows box ... Hope this helps ... cheers, MuS ... View more

Hi leantricity, on the server with the universal forwarder you can run this command in the CLI: $SPLUNK_HOME\bin\splunk.exe btool inputs list --debug Where $SPLUNK_HOME is the directory where you installed Splunk. The output of the command will show you the path and file where each option is configured. Hope this helps ... cheers, MuS ... View more

Hi patouellet, try this props.conf on the parsing Splunk instance, and restart Splunk after the change: [YourSourcetypeNameHere] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true CHARSET=UTF-8 LINE_BREAKER=([\r\n]+)\<162\>|\s\*NA\s\*NA(.*)\< TIME_PREFIX=\<162\> Hope that helps ... cheers, MuS UPDATE: Took this to slack and got more details, like it is a TCP input and the events actually do not contain *NA . After some tries this line breaker worked just fine: LINE_BREAKER=[\*\.\r\n\)\d]+()\<162\>|^()\<162\> The response of the OP was awesome, and I want to share it: ... View more

Hi dddillic, the interval will start when Splunk was last started. If you want more control over the schedule of your scripted input, use the crontab notation in interval . From the docs http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf : interval = [<number>|<cron schedule>] * How often to run the specified command (in seconds), or a valid cron schedule. * NOTE: when you specify a cron schedule, the input does not run the script on start-up. * If you specify the interval as a number, it may have a fractional component; e.g., 3.14 * The cron implementation for data inputs does not currently support names of months or days. * Defaults to 60.0 seconds. * The special value 0 forces this scripted input to be run continuously; that is, as soon as the script exits, the input restarts it. * The special value -1 causes the scripted input to run once on start-up. Hope this helps ... cheers, MuS ... View more

Hi pfabrizi, try this https://www.splunk.com/page/previous_releases or directly this assuming it is linux 64-bit wget -O splunk-7.0.4-68ba48f99743-linux-2.6-amd64.deb 'https://www.splunk.com/page/download_track?file=7.0.4/linux/splunk-7.0.4-68ba48f99743-linux-2.6-amd64.deb&ac=&wget=true&name=wget&platform=Linux&architecture=x86_64&version=7.0.4&product=splunk&typed=release' cheers, MuS ... View more