Hi I am looking for the best way to alert when a field value is not within a normal input range? For example, I have a field called 'Account_ID" and the only normal value should be 1 to 5 digits long, like 99999. I want to create an alert that triggers if Account_ID = is not a number but contains any characters other than numbers or greater than 5 digits. For example Account_ID = 87347 (good) Account_ID = 848/'A$ (bad - alert) or Account_ID = 9938848994994 (bad) Thank you for your help. ... View more

Just wanted to poll the community as I am currently testing this. Fyi - a UF on a SYSLOG-NG is not possible at the moment I have multiple inputs coming in on one tcp port. The logs I want to move to indx_b and sourcetype_b contain > |foo bar| as a pattern which I will regex. inputs.conf [tcp://666] Disabled = 0 index = indx_A sourcetype = st_A I want to try the following or any suggested variation props.conf [source::tcp:666] TRANSFORMS-Indx_B = SEND_TO_Indx_B TRANSFORMS-ST_B = CHANGE_TO_ST_B transforms.conf [SEND_TO_Indx_B] REGEX = \|foo bar\| DEST_KEY = _MetaData:Index FORMAT = Indx_B [CHANGE_TO_ST_B] DEST_KEY = MetaData:Sourcetype REGEX=\|foo bar\| FORMAT = sourcetype::st_B Is it possible to override the sourcetype based on the index its going to? e.g. REGEX = Indx_B ? Will a double override create a performance problem? or any other? Thank you ... View more

I am looking at confs I didn't originally create. btool check found: Invalid key in stanza [tcpout:A] in /opt/splunk/etc/system/local/outputs.conf, line 20: autoLB (value: true). Here is the stanza from outputs.conf [tcpout:A] disabled = false server = x.x.x.x:9997, y.y.y.y:9997 autoLB = true Any one know what the problem is? ... View more

My override index confs are breaking and I cannot find the cause... Currently I have logs from two sources (A and B) coming in on (port TCP 666) going to one index_A. Event logs containing: pipe two separate words pipe, like this ---> | Foo Bar | need to go into index_B. Inputs.conf [TCP://666] disabled = 0 connection_host = dns index = index_A sourcetype = st_A To override I created: in Props.conf [source::TCP://666] TRANSFORMS-Indx_B = SEND_TO_Index_B in Transforms.conf [SEND_TO_Index_B] REGEX = |Foo Bar| DEST_KEY = _MetaData:Index FORMAT = Index_B When I edit both confs and restart, I don't receive any conf errors on restart, but any events containing |foo bar| are lost or dropped from both indexes. I grep for either index in splunkd.log in /opt/splunk/var/log/splunk, but I am not finding any clues. Am I missing an error in my confs? Is there a specific log that might identify were the events are going? Please advise Thank you ... View more

So I was testing the SNOW TA with data from a URL like dev.company.servicenow.com. I was only collecting two tables sys_email and syslog_transaction, worked great for weeks. Today I switched out the URL to prod.company.servicenow.com, and changed the password. Username stayed the same and table permissions were the same. When I changed the pwd I got this error Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/Splunk_TA_snow/service_now_setup/snow_proxy/snow_proxy I ran a query and got some data, but it stopped at 2000 events. I checked service_now.conf and it shows the new password. So it looks like it took. When I check splunkd.log, I see: ERROR AdminManagerExternal - Failed to validate ServiceNow account or detect release info. Please verify credentials, urls for ServiceNow and proxy, and try again. Reason=%s Please advise how to troubleshoot this. Thank you ... View more

I have a typical scenario that could be resolved with a UF on syslog-ng, however that is a future resolution. At the moment, I have 2 data sources (A and B) coming in on a common port (e.g. TCP 666). Each data source needs its own sourcetype name and reside in a different index. So far, I have been trying to follow the docs and I created the following in .../opt/splunk/etc/system/local Inputs.conf [TCP://666] <------------------- this is the original data source stanza Disabled = 0 index = indx_A sourcetype = st_A Props.conf [sourcetype_B] <--------------------- I added this to accomodate data source B TRANSFORMS-routing = sourcetype_B_routing Transforms.conf [sourcetype_B_routing] <--------------------- I added this to accomodate data source B REGEX=|String_between_pipes| DEST_KEY=_TCP_ROUTING FORMAT=Everything, Subsidiary Outputs.conf I used two existing stanzas to direct the data to two different locations. [tcpout:Everything] <----- splunk destination disabled = false server = x.x.x.x, x.x.x.x <---------------------I have multiple destinations autoLB = true [tcpout:Subsidiary] <----------- 3rd party destination, data to be sent raw disabled = false sendCookedData=false server = x.x.x.x:port I need some guidance on connecting the inputs to the props>tranforms>outputs. How do I edit the inputs.conf stanza (or other location) to define index_B and sourcetype_B, and tie the inputs.conf to the other .confs? Thank you ... View more

I have an HF listener receiving syslog data from multiple sources. The source(s) events are going to the same index causing confusion. So I plan to create another index, separate the events, and route to the appropriate index. I believe this can be done with inputs and transforms, but I am not finding the correct documentation. Please advise. Thank you ... View more

I want to monitor log files and some custom files from /tmp/log_folder on a linux server. On the Linux box, the desired logs are scripted to /tmp/log_folder/ and this folder will be monitored by the UF. There is a script to clear out the folder every hour, any file older than 1 day. So far, I installed a UF on the server. Besides creating an inputs app (inputs.conf) on the UF and adding the monitoring stanza [monitor///tmp/log_folder/*] index=special_logs sourcetype = log_sourcetype ignoreOlderThan = 1d Do I need to add anything else? Thank you ... View more