[tcpout-server://x.x.x.x] is just a more specific way of defining destination host(indexer). Both definitions will work fine but [tcpout-server://x.x.x.x] will take precedence. Per docs, ############ TCP Output stanzas ############ # There are three levels of TCP Output stanzas: # * Global: [tcpout] # * Target group: [tcpout:<target_group>] # * Single server: [tcpout-server://<ip address>:<port>] # # Settings at more specific levels override settings at higher levels. For # example, an attribute set for a single server overrides the value of that # attribute, if any, set at that server's target group stanza. See the # online documentation on configuring forwarders for details. # # This spec file first describes the three levels of stanzas (and any # attributes unique to a particular level). It then describes the optional # attributes, which can be set at any of the three levels. #----TCP Output Global Configuration ----- # The global configurations specified here in the [tcpout] stanza can be # overwritten in stanzas for specific target groups, as described later. # Note that the defaultGroup and indexAndForward attributes can only be set # here, at the global level. # # Starting with 4.2, the [tcpout] stanza is no longer required. ... View more

In linux/unix, you can do this by running scripts with cron schedule. Please be sure to modify per your needs. Below are the two scripts which I use: This script should be invoked from deployment server. reload_deploy_server.sh #!bin/bash ## Variables date=`date +%Y-%m-%d:%H:%M:%S` user=`whoami` hostname=`hostname` info='INFO' error='ERROR' success='SUCCESS' fail='FAIL' reload_deploy='reload' workdir='/opt/splunk/scripts/' logfile='/opt/splunk/logs/log_for_scripts.log' userpass='your_admin_password' ## writes event in log file. echo -e "$(date +%Y-%m-%d:%H:%M:%S) $info $user $hostname $reload_deploy msg=\"Initiated reload deploy-server\"" >> $logfile /opt/splunk/bin/splunk reload deploy-server -auth admin:$userpass --answer-yes if [ $? -eq 0 ]; then echo -e "$(date +%Y-%m-%d:%H:%M:%S) $info $success $user $hostname STATUS msg=\"Reloading server classes\"" >> $logfile else echo -e "$(date +%Y-%m-%d:%H:%M:%S) $error $fail $user $hostname STATUS msg=\"Encountered some errors while reloading server classes\"" >> $logfile fi This script should be invoked from UFs. restart_splunk.sh ## Variables date=`date +%Y-%m-%d:%H:%M:%S` user=`whoami` hostname=`hostname` info='INFO' error='ERROR' success='SUCCESS' fail='FAIL' restart='restart' workdir='/opt/splunk/scripts/' logfile='/opt/splunk/logs/log_for_scripts.log' /opt/splunk/bin/splunk restart --answer-yes /opt/splunk/bin/splunk status if [ $? -eq 0 ]; then echo -e "$(date +%Y-%m-%d:%H:%M:%S) $info $success $user $hostname STATUS msg=\"Splunk is running\"" >> $logfile else echo -e "$(date +%Y-%m-%d:%H:%M:%S) $error $fail $user $hostname STATUS msg=\"Splunk is not running\"" >> $logfile fi Once scripts are in place, configure the crontab as below: ## Deployment server 0 7 * * 1 /opt/splunk/scripts/reload_deploy_server.sh ## Universal forwarders 0 7 * * 1 /opt/splunk/scripts/restart_splunk.sh ... View more

If you're looking for free education, you can refer to splunk docs for definitions of commands and practice them yourself. Or there is an amazing Advanced Search and Reporting with Splunk course offered by splunk. Coursework is really good and you will get to do labs. More info here: https://www.splunk.com/view/SP-CAAAH3M PS: I think others may have more good resources. ... View more

Hello, Please run below search to first check fields are extracted from all events (both short and long). your_search... | rex field=_raw "(?m).*dump\sto\sfile\:\s(?<AVL_DUMP>.+)[\r\n]App" | rex field=_raw "(?m).*App\:\s(?<AVL_Prog>.+)P" | rex field=_raw "(?m).*exception\shandler\:\s(?<AVL_Exec_handle>.+)[\r\n]?When" | rex field=_raw "(?m).*Reason\:\s(?<AVL_Reason>.+)[\r\n]?Register" If it is working, then use below extractions in your props.conf EXTRACT-AVL_Dump = (?m).*dump\sto\sfile\:\s(?<AVL_Dump>.+)[\r\n]App EXTRACT-AVL_Prog = (?m).*App\:\s(?<AVL_Prog>.+)P EXTRACT-AVL_Exc_handle = (?m).*exception\shandler\:\s(?<AVL_Exec_handle>.+)[\r\n]?When EXTRACT-AVL_Reason = (?m).*Reason\:\s(?<AVL_Reason>.+)[\r\n]?Register Also for pasting special text into questions/comments, please use "Code Sample" option (101010 icon OR ctrl+k shortcut) ... View more