We are seeing the same behavior, will update if we figure out a root cause or issue.  ... View more

Thank you so much, I got half way there with streamstats, but then got lost, this essentially got rid of some <streamstats field> -1 logic that was frustrating me!   had some events like this that i wanted dynamic columns for.  level1, level2, level3 level1, level2, level3, level4 level1, level3, level3, level4, .... level7 level1 couldnt figure how dynamically create columns with regex.  ... View more

thanks for this, looks like i'm running into the issue too. my older cert worked, the new one my cert auth team issued to me looks like it is single purpose openssl x509 -noout -in testold.pem -purpose Certificate purposes: SSL client : Yes SSL client CA : No SSL server : Yes SSL server CA : No vs openssl x509 -noout -in test.pem -purpose Certificate purposes: SSL client : No SSL client CA : No SSL server : Yes SSL server CA : No I have had my CA folks replace my certs and updated my Splunk. it now works. thanks !  ... View more

Has one tried using the modular inputs app?  ... View more

You would edit your metadata on that app to read for the specific group as opposed to everyone. The assumption that the AD group is mapped to a specific role. ... View more

This didnt work for us. ... View more

I'm also having this issue too. I'm using a search head cluster, my stream app location defined on the forwarder is the VIP sitting in front of the cluster. The forwarder is actively calling in so I'm not sure why my forwarder is not populating to my new group. ... View more

You are a lifesaver. I tried depth_limit and match_limit were no help. Had to do a little google foo to get this answer. Seem silly to pick 4k as a limit vs something like 8k is default for syslog-ng and 10k for other splunk limits. having our events cascading through multiple meta data modification has not been an issue, then we noticed long events were being singled out and not routing where they are supposed to be going. ... View more

Bummer no longer getting the other issue. but I am getting this [X509] PEM lib (_ssl.c:2997) ... View more

How in the hell did you figure this one out! ... View more

any updates on this. were seeing odd missing data when we do w real time api call, its missing data. but when we do a historical call for the same data the information is there. would like to rule out any truncation or limits settings. ... View more

Thank this also help me too. I was running into the issue 2 years ago decided just to ignore it. the flag provides so much satisfaction to get successful reloading message 🙂 ... View more

Solution was awesome. Thanks David. ... View more

I just wanted to let you know this panel javasript solution worked great for my panel refresh issue! thanks I upvoted this I wish I could mark it as the answer. ... View more

How can this be dont automatically? eval with spath in props.conf only breaks out specific field in the spath path. I'm dealing with hybrid logs like this too. ... View more

how did you do this? we have the same issue. are you using some kind of java script to do this? i'm lost on this part "This sets off a time on change of value. When timer sets off, it looks for the refresh icon available below each chart, and clicks it. Was the only way I found of doing it." ... View more

Here is how to filter from windows eventlogs from 6.4.2 inputs.conf.spec. EventLog filtering Filtering at the input layer is desirable to reduce the total processing load in network transfer and computation on the Splunk nodes acquiring and processing the data. whitelist = | key=regex [key=regex] blacklist = | key=regex [key=regex] whitelist1 = | key=regex [key=regex] blacklist1 = | key=regex [key=regex] blacklist2 = | key=regex [key=regex] These settings are optional. Both numbered and unnumbered whitelists and blacklists support two formats: A comma-separated list of event IDs and a list of key=regular expression pairs. These two formats cannot be combined, only one may be used in a specific line. Numbered whitelist settings are permitted from 1 to 9, so whitelist1 through whitelist9 and blacklist1 through blacklist9 are supported. If no white or blacklist rules are present, all events will be read. Formats: Event ID list format: A comma-seperated list of terms. Terms may be a single event ID (e.g. 6) or range of event IDs (e.g. 100-200) Example: 4,5,7,100-200 This would apply to events with IDs 4, 5, 7, or any event ID between 100 and 200, inclusive. Provides no additional functionality over the key=regex format, but may be easier to understand than the equivalent: List format: 4,5,7,100-200 Regex equivalent: EventCode=%^(4|5|7|1..|200)$% key=regex format A whitespace-separated list of event log components to match, and regexes to match against against them. There can be one match expression or multiple per line. The key must belong to the set of valid keys provided below. The regex consists of a leading delimiter, the regex expression, and a trailing delimeter. Examples: %regex%, regex, "regex" When multiple match expressions are present, they are treated as a logical AND. In other words, all expressions must match for the line to apply to the event. If the value represented by the key does not exist, it is not considered a match, regardless of the regex. Example: whitelist = EventCode=%^200$% User=%jrodman% Include events only if they have EventCode 200 and relate to User jrodman Valid keys for the regex format: The following keys are equivalent to the fields which appear in the text of the acquired events: Category CategoryString ComputerName EventCode EventType Keywords LogName Message OpCode RecordNumber Sid SidType SourceName TaskCategory Type User There are two special keys that do not appear literally in the event. $TimeGenerated : The time that the computer generated the event $Timestamp: The time that the event was received and recorded by the Event Log service. EventType is only available on Server 2003 / XP and earlier Type is only available on Server 2008 / Vista and later For a more full definition of these keys, see the web documentation: ... View more

We also have a similar issue, we have to do a rolling restart very often on our ES search head cluster, Then Data models need to be rebuilt, I don't think that such maintenance would be needed for our es data models. are there any best practices or solutions to keep data models in line? ... View more

The snow_config.py has an error check for the checkpoint file and when you disable the input and you run it again it look for conflicts and if it sees an existing file it cleans it and creates a new one. WARNING pid=3297 tid=MainThread file=snow_config.py:remove_checkpoint:423 | Clean checkpoint file: /$splunkhome$/splunk/var/lib/splunk/modinputs/snow/cmn_location.sys_updated_on your best bet is to grab the date in the check point file and add it as the since_when= date on the inputs.conf when you go to turn disable the input. then when you back to turn it on its already has the right date to look back to. ... View more

from what I've looked up you may need to setup an SNMP trap server and then have a universal forwarder read those files. ... View more

I feel as though I should slap myself in the face for not figuring this out on my own! just tried it and it worked. did this src_ip=":" ... View more