Hi, I am using the REST API modular input addon to monitor an elasticsearch instance on the stats api endpoint. The output is in JSON format and has an average of 1200 lines. I am using Heavy Forwarders and I have the following settings inputs.conf [rest://elastic-stats] source = elastic-stats auth_type = none endpoint = http://localhost:9200/_nodes/stats http_method = GET index = main index_error_response_codes = 0 polling_interval = 60 request_timeout = 55 response_type = json sequential_mode = 0 sourcetype = elastic-stats streaming_request = 0 props.conf [elastic-stats] SHOULD_LINEMERGE = false LINE_BREAKER = {"cluster_name": category = json_no_timestamp pulldown_type = 1 disabled = false elasticsearch api endpoint json output contains : Total Character Total Word Total Lines Size 26793 2230 1229 27.36 KB But only the first 10000 characters get indexed. Please assist & thank you in advance. ... View more

HI, I am using Monitoring of Java Virtual Machines with JMX (Splunk for JMX / splunk4jmx) app on a heavy forwarder. When i start the forwarder, there are no error messages and the information is retrieved from my JVM. But after a few minutes i get the error below and everything related to jvm monitoring stops. ERROR : ERROR ExecProcessor - message from "python /appserver/monitoring/splunk/etc/apps/SPLUNK4JMX/bin/jmx.py" It has been determined via the REST API that all inputs have been disabled I am not sure were the problem is, as other inputs are working without any problem. Please assist. ... View more

Hi, I am using a regular expression to extract the word that follows the string result of raw output. For endpoint 1 the captured value is "s"(incorrect) and for endpoint 2 the captured value is "OK" (correct). Using Splunk Enterprise 6.5.1 build f74036626f0c, and the regex was generated using RegexBuddy (language PCRE2 10.21 - closest to splunk, and here the correct value is highlighted in both cases). My inputs, props, transforms and raw output below. Would like some help on this, as i fail to understand from where "s" is captured. inputs.conf [rest://test] source = test auth_type = none endpoint = http://localhost:8130/test/v1/statuscheck http_method = GET index = main index_error_response_codes = 0 polling_interval = 60 request_timeout = 50 response_type = xml sequential_mode = 0 sourcetype = url streaming_request = 0 [rest://test2] source = test2 auth_type = none endpoint = http://localhost:8131/test/v1/statuscheck http_method = GET index = main index_error_response_codes = 0 polling_interval = 60 request_timeout = 50 response_type = xml sequential_mode = 0 sourcetype = url streaming_request = 0 props.conf [url] category = Custom pulldown_type = 1 disabled = false TRANSFORMS-url = url_transformation transforms.conf [url_transformation] REGEX = ^.+<result>(?<url_status>\w+).+ FORMAT = url_status::$1 WRITE_META = true Endpoint 1 raw output : curl http://localhost:8130/test/v1/statuscheck <status> <result>OK</result> <resources/> Endpoint 2 raw output : curl http://localhost:8131/test/v1/statuscheck <status> <result>OK</result> <resources><resource name="..." status="OK" /><resource name="..." status="OK" /></resources> </status> ... View more