Splunk Forwarder 7.0.2 (Windows 64 bit) Splunk Enterprise 7.0.0 (Linux) The strange problem: until 31/10, Europe TZ, logs are correctly indexed with this format (no Indexer props configured, set by default) [31/10/2019 23:59:55] [URL] [HTTP_RC] From 1/11, Splunk starts switching %m & %d in USA_TZ, so [01/11/2019 00:00:00] [URL] [HTTP_RC] become with timestamp (Europe) == 11/01/2019 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! And also today, i have 11/05/2019, but logs are [05/11/2019 00:00:00] [URL] [HTTP_RC] Why??????????????????? I know i should force the props in Indexers, such as, CHARSET = UTF-8 TIME_FORMAT = %d/%m/%Y %T SHOULD_LINEMERGE = false NO_BINARY_CHECK = true But why until 31/10 i have NO DATE PARSING problem at all? Suggestions? Thanks. ... View more

As in object, it's a strange behaviour, i can't use an IN clausole with host field in a map search. Here's my search, |inputlookup list.csv|where tag="locals" |map maxsearches=50 search="search index=* host IN($hostnames$) source=$source$|table host,source" First line works, all fields are passed to map (i also tried a display fields in the map search, and all fields are ok). Second line, the map, does not work with IN clausole and "hostnames" field with more than 1 host. list.csv NOT WORKING tag hostnames source locals host1,host2 /tmp/*logs locals host1,host2 /tmp/*TXT locals host1,host2 /tmp/*json WORKING tag hostnames source locals host1 /tmp/*logs locals host2 /tmp/*logs locals host1 /tmp/*TXT locals host2 /tmp/*TXT locals host1 /tmp/*json locals host2 /tmp/*json I also tried a host IN(*$hostnames$*) but this is like an IN(**), variable seems to be null, but i can display if i try a |makeresults|eval host=$hostnames$|table host Why? Suggestions? ... View more