I have splunk installed on windows os in production environment and I want to know by which user splunk is installed whether it is local user/domain user? and What is recommendation for splunk installation on windows os by which user is prefrable. ... View more

I have below sample events in log file- 2019-07-19|23:02:24.213|TEST|XYZ|Test1 2019-07-19|23:02:24.213|TEST|XYZ|Test2 2008-12-31|19:01:22.265|TEST|XYZ|Test3 2008-12-31|19:01:22.359|TEST|XYZ|Test4 Here it can be seen that few of last events are coming for Year 2008 due to which my all events are becoming of 2008 year in splunk although i mentioned time format/time prefix and by default MAX_DAYS_AGO is 5.48 years so it should not index these events ..below is my props.conf- [sample_st] LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true category = Custom pulldown_type = 1 disabled = false TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%d|%H:%M:%S.%3N TRANSFORMS-set= setnull,setparsing,replacedefaultsource ... View more

I want to know if below things are possible in splunk and if YES then How it can be achieved- 1. Below is sample events 2019-07-16|21:15:43.370|INFO|This is a statement 2019-07-16|21:16:43.370|INFO|Random statement 2019-07-16|21:17:43.370|INFO|Random statement 2019-07-16|21:18:43.370|INFO|This is a statement 2019-07-16|21:19:43.370|INFO|This is a statement I have heavy forwarder where I want to index only first occurrence of "This is a statement" line and do not want other lines which contain "This is a statement" string to be index. Since same line coming multiple time in log file and I want to index only first occurrence of it. 2. Below is another sample events 2019-07-16|21:15:43.370|INFO|Temprature-30 2019-07-16|21:16:43.370|INFO|Temprature-30 2019-07-16|21:17:43.370|INFO|Temprature-30 2019-07-16|21:18:43.370|INFO|Temprature-32 2019-07-16|21:19:43.370|INFO|Temprature-32 Here I want only two lines which has distinct temprature to be index. are these above two strings possible in splunk? I want these to be done before indexing so to reduce indexing volume. Currently I am using nullqueue and indexqueue to parse required data but now I want to index only first occurrence. Appreciate your help. ... View more

I want to keep specific events which contains few strings in event but around 30 OR statement I have to write in regex to keep these events like below my transforms.conf- [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = (\|abcType=|\|abcId=|KType=Sys,\sDate=|abc\sxyz.exe\sZzzz|abc|xyz|pqrs|\JType=test,\sStats=ok) DEST_KEY = queue FORMAT = indexQueue below are few strings i am checking in regex- |abcType= |abcId= KType=Sys, Date= abc xyz.exe Zzzz abc xyz pqrs JType=test, Stats=ok These are 30 strings which I am checking in event so I want to know how feasible it will be or is there any better option? ... View more

Hi, I am monitoring zip files from folders with below inputs.conf: What does the number of files denote shown in the screenshot? Does that mean the number of files indexed or the number of files only monitored since I am giving ignoreOlderThan in inputs.conf? [monitor://\\abcstoragen\PQRS\XYZ\(AbcdLogs|ABLogs)*\...\*.zip] disabled = 0 index = abc sourcetype = pqr ignoreOlderThan = 3d crcSalt = <SOURCE> A number of files shows high count but yet no file is indexed and it is increasing since recently I created a new input. Thanks! ... View more