If you just test this part, | inputlookup yourlookup.csv | eval host=cn | return host You'll see it returns an OR list of the hosts ... View more

Your suggestion would worsen things even more. Because you would be doing the statistics over all the events instead of starting by filtering them right away ... View more

Unfortunately you are searching a non indexed field named eventtype. If you were;t your performance would be x1000 like this | tstats count where index="systems" AND sourcetype="WindowsUpdateLog" by host | | search [inputlookup serverlist.csv | rename cn as host | return host] But unless you start indexing that.... ... View more

In the dashboard, Edit Source, go to where the panel where the report is referenced, and copy the search name <search ref="ReportName"></search> to the title ... View more

You can easily edit the panel where the report is and add the title to it ... View more

Great. Honestly never had seen that requirement, but it is under the normal logic of splunk things ... View more

Does this happen with either of the Peers you take down? ... View more

Pardon the misunderstanding, I should have noticed that too. I would say you found a bug there. That Z has no documentation about it so probably a mistake there. Ultimately you can do a test yourself with that TIME_FORMAT but according to Splunk docs that is not recognized. Hope I helped anyway ... View more

What is that new release 1.0.1 of props ? Release of what exactly? Who added that "Z" in the end without anything else? Where is that coming from? ... View more

Hi Please check this document where it states that %Z (not just "Z" gives an abbreviated TimeZone Indicator: The timezone abbreviation. For example EST for US Eastern Standard Time) http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Commontimeformatvariables ... View more

The reason is that sourcetype override occurs after timestamp recognition and breaking into events. It doesn't work the way you want, which is override Sourcertyoe and only then break into events It is expected behaviour. Each block only goes through the parsing pipeline once ... View more

Hey Not a misconfiguration, I have a brand new ES install and the same thing occurs to me. What goes through my mind is, imagine if you don't specify any cim_Authentication_indexes, then Splunk should still try to get over your lack of accuracy in that matter, so it searches them all by default. For me it is just a protection against the case where you are not specific. I*f no index was set, Splunk would only search the default indexes like main (well depending on what default indexes are in the role splunk-system-user used to run the accelerations)* ... View more

Ok good it is working. The time may be missing for two reasons. Is the timestamp written after the 128th character in the event (which is the default of the parameter MAX_TIMESTAMP_LOOKAHEAD). Increase the MAX_TIMESTAMP_LOOKAHEAD if it is the case. More, to make sure timestamp is recognised by Splunk, use the TIME_FORMAT parameter in the sourcetype definition (below the TRANSFORMS-sourcetype = sourcetypechange). TIME_FORMAT=%b %d %H:%M:%S For info on how the time variables work, http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Commontimeformatvariables TIME_FORMAT = <strptime-style format> * Specifies a strptime format string to extract the date. * strptime is an industry standard for designating time formats. * For more information on strptime, see "Configure timestamp recognition" in the online documentation. * TIME_FORMAT starts reading after the TIME_PREFIX. If both are specified, the TIME_PREFIX regex must match up to and including the character before the TIME_FORMAT date. * For good results, the <strptime-style format> should describe the day of the year and the time of day. * Defaults to empty. ... View more

This parameter can also be tuned and useful if you still fear that behaviour could ever happen time_before_close = <integer> * Modification time delta required before the file monitor can close a file on EOF. * Tells the system not to close files that have been updated in past <integer> seconds. * Defaults to 3. ... View more

You can't control how fast Splunk is checking the file for new events. The thing is, Splunk is set up for this case as you can see in the docs: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Howlogfilerotationishandled Also I've never seen such a case where a part of a log has been written and the file was immediately rolled so fast Splunk wouldn't detect the new part of log. ... View more

Please accept the answer it solves your issue ... View more

Yes you are correct, the monitor stanza I'm talking about is what you called Directory data source. Monitor is the correct way to monitor files when you have actually the ability to do it. I'm not sure what you mean by "aggressive". Is it taking too long to index data? The "catch up" time is normal specially if you have very big files and a large number of them. Maybe you need a second pipeline in that Universal Forwarder: https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configureaforwardertohandlemultiplepipelinesets ... View more

Splunk uses Regex PCRE flavor of regular expressions, so anything that is PCRE-compliant is good to go. Did you make sure that was the flavor you were testing? ... View more

Sorry it was my mistake about the syntax, nothing wrong with yours. Splunk applies the regex to the whole event. You should use a regex that uniquely identifies the kind of events you want to override Sourcertyoe. That is the criteria, a regex enoughly long and that let's your events be overridden. Are you sure your regex is capturing the events? ... View more

Hi A Universal Forwarder has no capability to parse data some metadata stamping on the events. A Heavy Forwarder is a full Splunk Instance with all the capabilities of Splunk Enterprise. You can simultaneously use a Heavy Forwarder to send data (just like a Universal Forwarder does) and also parse and Index data. Note one thing: when data goes through the parsing pipeline in a Heavy Forwarder, either it is indexed or it is sent already processed. On the contrary, data coming out of a Universal Forwarder goes in blocks, meaning it hasn't been "cooked" (line breaking, line merging, truncating etc). ... View more

No, just put a monitor on that folder and Splunk will read everything in that directory substructure by default and you don't have to worry about it. By the way the option is called recursive and the default is true. I believe this solves your issue. Let me know ... View more

Yes, I promoted my last comment to an answer so please accept it below ... View more