The short answer is that you changed the sourcetype before your [instance] transform could operate on it.  I get that this question was first asked 6 years ago, but hopefully this answer reveals similar issues that others may be encountering. Transforms are applied in alphabetical order by the props name and in the order set in each transforms call. The order set lists createsource first and instance second: [tomcat-appl] TRANSFORMS-set = createsource, instance So, [createsource] changes the sourcetype so that the data no longer matches "tomcat-appl" for [instance] to apply to it. Listing the props transforms calls separately follows the props name rule, where props are called in alphabetical order by prop names: [tomcat-appl] TRANSFORMS-instance_set = instance TRANSFORMS-createsource_set = createsource [createsource] starts with a "c", which is before the "i" of [instance].  So [createsource] applies first and changes the sourcetype so that [instance] cannot apply to the data (different sourcetype now). ... View more

@meenal901 based on which region is this for, please contact the Splunk Sales team: https://www.splunk.com/en_us/about-splunk/contact-us.html ... View more

Oh I wish I could 😛 I will try the SOURCE_KEY and DEST_KEY as password and try again. ... View more

Hi @jackreeves, Extremely sorry for delayed reply and to know that you were not able to get the results. I have updated the app to include error handling as well as logging. Could you please try with the latest version and let me know if you're still facing issues? Thanks, Meenal ... View more

Thank you meenal, I changed the names and it works perfectly fine. ... View more

First answer here shows how to do what you need, without CSS https://answers.splunk.com/answers/204419/do-this-in-simple-xml.html ... View more

@brian1_tate you have to make sure that _internal is added as the Indexes searched by default from the Settings > Access Controls for it to be picked up by metadata command. By default, the index searched by default setting for admin is main index only. However, since admins have Available search indexes set to both all internal and non internal indexes stats command would still work to pull stats from _internal index. If you run the following command and do not get any results then there is no default index set. | metadata type=sourcetypes If you run the following command (search all internal indexes is specified explicitly through index=_* ) and you get results that means you have access to search internal indexes, they are not set as default indexes. You would need to correct the Index Searched By Default setting for the specific role from Settings > Access Controls | metadata type=sourcetypes index=_* Refer to the following blog as you can also run Metada Command to create your own Summary Report of indexed event for each source/sourcetype/host : https://www.splunk.com/blog/2017/07/31/metadata-metalore.html Hope this explains the details you are looking for! Kindly let us know if you need further information 🙂 ... View more

This error occurs when your Search Heads attempts to send a search job to a Search Peer (usually one of your Indexers) and the Indexer does not respond in within the default timeout period so the Search continues but without using that Indexer (which of course probably means that some of your events are not returned so your search is wrong). In my experience, the problem can often be cleared simply by restarting the Splunk instance on the Indexer in question but sometimes you need to dig deeper. In any case, something is keeping your Indexers so busy that it cannot reliably respond to search requests even though the Splunk instance is running. I am sure this kind of thing can also commonly be caused by misconfigured/misbehaving load-balancers or other identity/load-shifting equipment that is between your Search Head and your Indexer peers. ... View more

Restarting SPLUNK helped! Thanks meenal901 ! ... View more

source="/home/splunk/nagios_temp/var/nagios.log" NGTC*P OR NGTC*S status_code="DOWN" OR "CRITICAL" OR "HARD" NOT OK NOT SOFT | dedup 1 host_name sortby -_time | transaction maxspan=5s maxpause=>300s | lookup TCSiteXref.csv host_name OUTPUT site_name, site_weight, total_weight | search site_name=* | stats min(site_weight) as site_weight min(total_weight) as total_weight by site_name | eval availability_metric=(total_weight/site_weight) | fields availability_metric, site_name | top availability_metric availability_metric count percent 703.492374 3 33.333333 684.983196 1 11.111111 671.700154 1 11.111111 658.223864 1 11.111111 530.223672 1 11.111111 436.152859 1 11.111111 305.26611 1 11.111111 Want site_names (field) to the left. And after all that I will have to get an overall percentage (only equals 99.999999% I realize) to show in a panel. Thanks ... View more

I tried edit roles capability. what it will do is not accepted by my. If I give this capability to a user, it can create other users with admin capability as well. Even if the user itself is not an admin. This is much simplified in 6.4 ... View more

Very nicely written. Thanks 🙂 ... View more

thank you rich7177 and everyone here. It has truly helped me to nail down the issue and logs have started ingesting into Splunk. Yes I did compare the inputs/outputs debug logs from the two servers and found that wb030 wasn't added to one of the App that forwards the indexers config to it. I added the host and could see the logs started ingesting into splunk. ... View more

https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html i got it 🙂 ... View more

Are your events actually multiline events? Or single line events with long messages in it? Your example seems to have a message content enclosed with quotes " ... " My regex for break_only_before is wrong, should be: BREAK_ONLY_BEFORE = \w+ \w+ \d{4}\/\d{2}\/\d{2} ... View more

there could be more data coming and parsing queue is full ... View more

Agreed.. It may not be possible to filter out based on REGEX in props/transforms. ... View more

thank you @helenashton! this is great. I hesitated to try it at first thinking it wouldn't make sense after the | table line in my search, but it works exactly as expected! in your search, you | table all the fields you need to keep and then copy only the field names you want to be visible into the |fields line. ... View more

Yes you can, though at the current (6.2) version there the DMC has no such role as Heavy Forwarder, the closest one it has predefined is Indexer - as the HF actually cooks the data. ... View more

There's are HUGE caveats to the key routing method to re-parse data: a) unsupported (don't bother opening a case about it) b) untested (e.g. it has worked in the past but is not QA'd so could break at any point) c) applies to ALL inputs on the system you set it up on -- regardless of the stanza it's applied in, so you are essentially relegating an IF to a single input. ... View more

Can this be possible: I route the unwanted data to DEST_KEY=SYSLOG, localhost:541 Then by using SYSLOGNG monitor the 541 port and redirect to a flat file instead of another Splunk instance? Thanks, Meenal ... View more

Additionally, the effort to perform the 50% filtering you mentioned depends heavily on how the filters are built. Very simple filters won't have a huge impact while complex (badly built, usually) filters can make your servers grind to a halt. Therefore it's impossible to say based on just a few numbers how many HFs you need, whether it'd make sense to use HFs at the sources instead of UFs, whether it'd make sense to send 100% to the indexers and filter there (network? legal issues?), and so on. Schedule a workshop with your local Splunk Partner or Splunk Sales Engineer. ... View more

Hi meenal901, see the docs about filter event data and send to queue for some good examples on this topic. Create a nullQueue transform for B and a second for C and it should work for you. cheers, MuS ... View more