Can you explain the regex? it looks like (?::) looks for any field identifier... but what about {0}? Is that for zero of that field identifier? I am asking because I am trying the stanza below and it doesn't seem to be working: [source::(top)|(ps)|(bandwidth)] Context: sending ta_nix data from UF to HF, then using RFS to send to flat file. The stanza aboves simply routes the data to the destination using ingest actions.  Thanks! ... View more

If you edited a setting within the default folder (something you should never do) simply do an upgrade or refer to the spec file where many of the defaults are outlined in the setting's description: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf ... View more

In your props.conf on INdexer/Heavy Forwarder (if any), add this to your sourcetype. props.conf (on Indexer/Heavy Forwarder) [YourSourceType] ..other settings.. SEDCMD-removeheader = s/^(\S+\s+)(.*)/\2/g ... View more

Rewrote ./bin/ta_ontap/OntapPerf.py to query system:node instead of system (as held in the objectType parameter), when ontap v8.3+ is detected. Amended OntapClinet.py as well (to manage querying the ontap version). Not a 100% fix, as it appears some of the resulting attributes are different - not a perfect 1:1 match for data structure - but good enough for us. Small print in the hardware and software requirements for the Splunk app do actually note that only up to 8.2 is supported... Splunk App developers have been contacted with details of my workaround. ... View more

@somesoni2 - thanks for the query. i will check on Monday if i have access to rest api and see how that search goes. ... View more