Need some help with deploying and merging an app. We have a deployment server that store apps in following folders:~/etc/deployment-apps/all This is where we have all app going out to all server.~/etc/deployment-apps/spesial This is custom config for one server. in the all folder we have an app like this: test.app/default/app.conf with the following content; [ui] is_visible = false in the spesial folder we have an app like this: test.app/local/app.conf with the following content [ui] is_visible = true Serverclass.conf looks like this: # Send all app to all servers [serverClass:send.to.all.servers] repositoryLocation = $SPLUNK_HOME/deployment-apps/all restartSplunkd = true restartIfNeeded = true issueReload = true whitelist.0 = * [serverClass:send.to.all.servers:app:*] # Send this apps only to server Mars1 [serverClass:send.to.mars1.servers] repositoryLocation = $SPLUNK_HOME/deployment-apps/spesial restartSplunkd = true restartIfNeeded = true issueReload = true whitelist.0 = Mars1 [serverClass:send.to.mars1.servers:app:*] Problem is that only one test.app are sent out. I would like that both are sent out and merged inn to one app with both the local and default folder (local will take presidiene) If I remove one of the apps, the other will be sendt out but not both. How can I accomplish this (without using external script etc)? Have read trough the serverclass.conf file without seeing any easy way to solve this. ... View more

We have a rather huge solution with 2000+ servere.    Our company needs that we monitor the IIS logs. Problem is that not all server has IIS and some have logs on  C: drive and other on E: drive. We did then setup to monitor "E:\inetpub\logs\LogFiles" and "C:\inetpub\logs\LogFiles" on all severs.  It would be impossible to select just the servers with IIS running.   The result of this is that we do get lots of warning in our logs. Some server have logs in E and some in C and som do not have IIS logs, so logs are filled with this messages:   11-19-2022 16:22:04.199 +0100 WARN FilesystemChangeWatcher - error getting attributes of path "E:\inetpub\logs\LogFiles": The device is not ready.   1. Does this give any problem?  2. This clogs up the logs, so its harder to find real problem, so if this logs are not giving any problem, can it be turned of for some monitored files? ... View more

I was searing for a simple way to convert all types of mac address to "more" standard format.  Found various solution, but not a single line that I did like, so I made one. This will convert any mac format to XX:XX:XX:XX:XX:XX. (Output can be modified to format of your choice.)   | rex mode=sed field=mac "s/[^0-9a-fA-F]//g s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/g y/abcdef/ABCDEF/"   s/[^0-9a-fA-F]//g remove all that are not 0-9 a-z and A-Z (all symbols are gone) s/(..)(..)(..)(..)(..)(..)/\1:\2:\3:\4:\5:\6/g set the output format to xx:xx:xx:xx:xx:xx y/abcdef/ABCDEF/ change to upper case   ... View more