I added an app recently to pull in PowerShell Transcription logs that are output to C:\Logs\YYYYMMDD\YYYYMMDDHHSS.randomstring.log So I created the following app: [monitor://C:\Logs\*\*.txt] followTail=false disabled = false sourcetype = ps_transcript index = powershell On some systems, PS is being run constantly from certain program/script updates. (10k in 24 hours on one server in particular). This creates a lot of small files that Splunk universal forwarder (UF) picks up. However, Splunk UF's CPU and memory usage has been going crazy with this. It isn't the size of the events, but I believe more of the number of files it has to monitor. Is this accurate? Is there a way to return the CPU usage to normal while still consuming the PS logs? ... View more

I recently pushed the Splunk_TA_nix App. In it it has a line to pull Bash history. However I'm noticing that everytime a user logs in it pulls in their whole bash history file whenever changes are made. So person A logs in 3 times in a day... there are three full histories of stuff they did weeks ago in splunk time stamped for today. I'm trying to figure out how to stop this duplication from happening. Fschange seems like it might work but it sounds like it is depreciated so would prefer something that isn't going to randomly drop. This is what the app has in the stanzas: ### bash history [monitor:///root/.bash_history] disabled = 0 sourcetype = bash_history index = os [monitor:///home/.../.bash_history] disabled = 0 sourcetype = bash_history index = os I did try adding in the temporary followTail but to no avail. ... View more