We have 9 accounts in AWS. I have set up AWS Config on each account, pointing to their own SNS topic. I have one SQS Queue in us-east-1 subscribed to the SNS topic from each region, which should allow Splunk to watch a single endpoint for notifications as setting up all 9 regions for all 9 accounts seems like it would be an excessive drain on my Splunk server to ping these on a regular basis. A few questions: Will this work as configured? If it will not work, how bad of a performance hit am I going to have if I setup all 9 accounts against all 9 regions? Should I simply raise the default checking time? ... View more

Our application has a very readable, but quite unindexable format. Currently, its coming in as multiple lines, which is making my search results a bear to deal with. The format looks like this: Entering: Client:ClientCompanyName LoggedInUser:[email protected] Class:SurveyDAO Method:isAdminUser([email protected]) StartTime: 2015-01-30 00:54:44 678 Query:select adminFlag from Accounts where id= ? EndTime:2015-01-30 00:54:44 990 Anyone provide some help in defining a decent file input for that? ... View more