Hi there!   Can a deployment server run the TA *nix?  I also have this TA deploying out to UFs, but lives under $SPLUNK_HOME/etc/deployment-apps.  Is it as simple as copying the Splunk_TA_nix directory from $SPLUNK_HOME/etc/deployment-apps into $SPLUNK_HOME/etc/apps and placing my outputs.conf into $SPLUNK_HOME/etc/system/local ? Thanks in advance. ... View more

Hello Splunk community! I have a monitored input file. A process writes a header to a continuous log file and about a minute or so later results are appended to the log. Because the lag between the header and the results is so great, Splunk is seeing this as two separate events, where in fact it should be one multi-line event (header & results). I've tried all sorts of line breaking options in props.conf but nothing seems to work. Does anyone out there have any suggestions? I can recreate it with a simple test script with a sleep, running through a while loop. echo " date "+%F %T" This is the header" >> $OUT sleep 30 echo "Slept for 30 seconds" >> $OUT echo "DONE" >> $OUT SHOULD_LINEMERGE=true CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=25 TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%d %H:%M:%S BREAK_ONLY_BEFORE_DATE=true NO_BINARY_CHECK=true ... View more

We have EC2 deployment clients in AWS. They are auto scaling clients. They come and go as workload scales. Each client has a unique client name. What is the best way to delete the clients that have not phoned home in the past 12 hours? I've been manually deleting them from the deployment servers but would like to automate that task. Hoping for some ideas and tips. Thank you! ... View more

Is it possible to process a specific date/time format first and if the format doesn't match the regex, default it to another? Nov 19 21:56:10 myhost1 myapp1 2018-11-19T21:56:10.394Z level=INFO Nov 19 21:57:20 myhost2 myapp2 [10.110.101.85]: 2018-11-19 21:57:20:322 [INFO ] Nov 19 21:58:30 myhost3 myapp3 status=failed exit_code=2 My props is set for the TIME_FORMAT of %Y-%m-%dT%H:%M:%S.%3N%Z using a regex TIME_PREFIX for everything before the date/time 2018-11-19T21:59:10.394Z (as in the first event). If the TIME_FORMAT doesn't match or doesn't exist (as in the second and third events), then I'd like to use the first date/time in the beginning of each event (Nov 19 21:57:20). Is this possible? If so, how would this be accomplished? ... View more