Hi, We are trying the index-time field extraction for a specific case, and have no idea about the correct configuration. Our CSV files contain headers with field names (not configured on forwarders), and we want to extract on index-time 2 fields out of 15. csv example: A,B,C,D,E 1,2,3,4,5 10,20,30,40,50 20,30,40,50,60 30,40,50,60,70 (we want to extract on index-time fields B,C) What should we configure on props.conf and transforms,conf on indexers? ... View more

Hi, We used to have Splunk DB Connect lookups to Advanced SQL with parameters (using $field_name$ as an identifier) - which let us use special queries as lookup Since version 2, we can't find a way to have these special queries. Is there any option to config customized queries? Thanks, EG ... View more

Hi, We're considering to raise the number of indexers servers (peers) with reducing the IOPS per server FS due to IOPS limitations in our hardware. Does this calculation fit? For instance, does 10 servers with 600 IOPS S-ATA based are equal to 5 servers with 1200 IOPS SAS based in case of 500GB/day indexed data? Thanks, EG ... View more

Hi, I'm using the stream forwarder in order to index .pcap files into splunk. Is there any way to add the source path of pcap (filename) to the indexed events? In general, is there any way to intervene in the parsing process? Thanks, EG ... View more