Thanks for your input! ... View more

Yeah True! But just wanted to check if that way is possible in the Monitor stanza. Just to reduce number of stanzas in inputs.conf file. ... View more

Below one worked well: props.conf [syslog] TRANSFORMS-routing_for_syslog1_index = route_to_syslog1_index #transforms.conf [route_to_syslog1_index] DEST_KEY = _MetaData:Index SOURCE_KEY = MetaData:Host REGEX = xyz FORMAT = syslog1 Thanks for the help! ... View more

This is my actual props & transforms settings: [source::tcp:5514] TRANSFORMS-idx = syslog_idx [syslog_idx] SOURCE_KEY = _raw REGEX = .+ DEST_KEY = _MetaData:Index FORMAT = syslog Do I need to add the above stanza's separately or under these?? ... View more

Thanks for the reply. We have hosts with xyz, xyz1, xyz2. So in regex can we give xyz*, will it take?? ... View more

We tried copying timewrap (2.4.0) app to /opt/splunk/etc/apps/ folder for our splunk 6.4.2 and seems working fine! ... View more

Hi, Here is my query: select * from tablename {{WHERE to_date($rising_column$,'DD-MON-YYYY HH24:MI:SS') > to_date(?,'DD-MON-YYYY HH24:MI:SS')}} Yes, I have set! ... View more

Hi, It is a simple message stating "Show Source not available for this event" ... View more

Hi, Log type is Log4j. ... View more

My java location is /opt/splunk/java8/jre1.8.0_60/, do you want me to move java to "/opt/jre1.8.0_40/bin/java" and configure it again?? Current configuration is working from so many days, all of a sudden we are seeing this issue. Jvm options : -Xmx2048m -XX:+UseConcMarkSweepGC ... View more

This I could find: CHECK_METHOD = [endpoint_md5|entire_md5|modtime] * Set CHECK_METHOD endpoint_md5 to have Splunk checksum of the first and last 256 bytes of a file. When it finds matches, Splunk lists the file as already indexed and indexes only new data, or ignores it if there is no new data. * Set CHECK_METHOD = entire_md5 to use the checksum of the entire file. * Set CHECK_METHOD = modtime to check only the modification time of the file. * Settings other than endpoint_md5 cause Splunk to index the entire file for each detected change. * Defaults to endpoint_md5. * Important: this option is only valid for [source::] stanzas. And also I could see below warning message on my forwarders: WARN TcpOutputProc - Read operation timed out expecting ACK from indexer in 300 seconds. ... View more

Hi fdi01, Thanks for your reply. Looks like default option is endpoint_md5, we need to explicitly mention this in props?? and my abc.out file is rotated based on size, if it reaches some size it will rotate and new file will get created. Here is my error message: WARN TcpOutputProc - Possible duplication of events with channel=source::/123/.out|host::xyz|out-2|571, streamId=0, offset=0 on host=indexer:9997 what is out-2 in the above warning, if it is sourcetype, sourcetype given as per above configuration file is abc, then why is it showing out-2?? I am using indexer acknowledgement using useAck=true. ... View more

Code working as is with out making changes "place mvc.Components.get('table1') with mvc.Components.get('chart1') as chart1", ensure you have d3.js script in the same app from where you are saving these custom js & css scripts. ... View more

Thanks & yes I am running two instances on two different ports! ... View more