I don't know if wildcard sourcetypes work, but I've had success with using the [default] stanza in props.conf. [default] LOOKUP-src_user = user_ips src AS ip ... View more

This is definitely a non-standard use case. As @adonio mentioned, it may be worth reconsidering the value in indexing a file with no changes at an interval basis. That said, would you be allowed to use a modular input with this client? It is technically a script, but so it a good portion of Splunk itself. ... View more

Where is this props/transforms in place? On the indexer, heavy forwarder, universal forwarder, or search head? ... View more

I mean only swapping out line 5 in your search for the line I gave: source="test.csv" | eval Year=strftime(_time,"%Y") | eval Month=date_month | chart distinct_count(ticket_number) as "Cantidad tickets" by Month Year | eval orden = strftime(_time, "%m") | sort orden | fields - orden ... View more

I think he's saying your macro needs to look like: [<macro name>] search = ldapsearch ... And you would do this in your search string: | `<macro name>` ... View more

You could have also probably done | eval orden = stftime(_time, "%m") ... View more

Specifically you just can't start a macro with a pipe. ... View more

What do you mean "search KEYWORD1 and KEYWORD2 inside the text files"? The way I'm parsing it right now it seems like you mean this: source=*.txt SQLDB KEYWORD1 KEYWORD2 Which would give you events from any .txt file that has the words "SQLDB", "KEYWORD1", and "KEYWORD2" present. ... View more

Did you run that on the forwarder or indexer? The indexer is where your inputs.conf will be configured to receive from your forwarder, so you need to check the configuration in the indexer’s inputs.conf. ... View more

The posted query assumes that you would run this for a 30-minute span, snapping at the half hour. So, 01:00-01:30. Over that window, the search would have a result if the 01:15-01:30 span had 40% fewer events than 01:00-01:15. If you run the search without snapping to a 15-minute end time then, yes, results will change over time. I'm not entirely sure what you mean by current, but if you mean "right now, not over a 15 minute span" then things get trickier. The below search assumes that you've searched for any 30-minute span, and creates two buckets of time ("fifteen minutes ago until now", and "everything else"). You could run this search every minute and you would get more new results each time, but they would be the most current results, and based entirely on the last 15 minutes compared to the 15 minutes before that. <your base search> | addinfo | eval fifteen_mins_ago=relative_time(info_max_time, "-15min") | eval _time=if(_time>=fifteen_mins_ago, fifteen_mins_ago, info_min_time) | stats count BY _time | streamstats window=1 current=false last(count) AS last_15_min_count | eval pct_of_last_15_min_count=(count/last_15_min_count)*100 ... View more

Have you tried searching "all time" for that source, to make sure it didn't just get the timestamps wrong? And speaking of timestamps, you have ignoreOlderThan set, so if Splunk is really failing to correctly parse the timestamp that could result in events being skipped. ... View more

POST is an HTTP action. The code you write, in javascript, will run in the user's browser and attempt to make an HTTP call based on what you've asked it to POST to. Placing a python script on the server is unlikely to allow it to receive HTTP events. I think you'll need to take a step back and work to gain an understanding of not only what it is you're looking to accomplish overall, but how the individual components may be used successfully to gain that functionality. ... View more

Don't make changes in any default/ directory. The proper location to make changes is in one of the local/ directories. See the documentation regarding this concept. Based on the fact that you made the changes in default/ , I'm not surprised you see requireClientCert=false . You need to look at your configurations as a whole, not just one config file to see where requireClientCert=true may be set. Try this: splunk btool inputs list --debug | grep requireClientCert That command will fetch the configurations as they will be used (considering precedence), and include the name and location of the file where the current setting exists. ... View more

Which user is the Universal Forwarder running as? Does that user have permission to read the files being monitored? ... View more

How are the events coming in that have the sourcetype audittrail ? As an aside, you don't need the parentheses around login attempt , as you don't use this value later for anything. ... View more

In outputs.conf, you also need to define a default output group, which needs to be a dummy one (which will be overridden by your transform when you actually want to forward the event): [syslog] defaultGroup=noForwarding And if this same Splunk instance also needs to forward, this also needs to go in outputs.conf: [indexAndForward] index = true Note: The Splunk docs state defaultGroup isn't required if you don't want to forward by default, but my testing for a recent answers post suggested if it's not set it won't forward at all. ... View more

Please share your indexes.conf on the indexer inputs.conf on the indexer inputs.conf on the forwarder props.conf on the forwarder outputs.conf on the forwarder that you have put in place for this task. ... View more

Considering your latest answer post, did this solution not work for you, or did you just decide you don't want to have the six header lines associated with the first event? ... View more

I'd suggest sending them to nullQueue at index time. The configuration to do this may look something like the below. props.conf: [<sourcetype>] TRANSFORMS-removeHeaders = removeHeaders transforms.conf: [removeHeaders] REGEX = ^[^0-9] DEST_KEY = queue FORMAT = nullQueue Specifically this will drop any line that does not start with a number. For general direction, consider reading the Route and filter data documentation. ... View more

How are you hosting the python script that it can receive POST requests? ... View more

inputs.conf is only part of the solution. This documentation page steps you through enabling the receiver on the indexer and adding a forward server on the forwarder. ... View more

Which addon did you deploy? Does this addon set the host value based on the event payload? Did you enable the inputs? You may want to start by including your inputs.conf from the forwarder to enable additional help. ... View more