Hello, We added several fields with the _meta keyword in inputs.conf. When we search for the fields with "field::value" it is working, but when using "field=value" instead, there are no results. We already added the new fields in fields.conf with "INDEXED=true" and "INDEXED_VALUE = false" options on our Search Heads, or is it needed to adapt the fields.conf settings on the Indexers as well? Is there anything else to keep in mind? Thanks, Rainer ... View more

Hello, Today I modified the /etc/system/local/authentication.conf file on all Search Head Cluster members because most settings should be pushed by the Deployer in a separate app. Authentication still is working fine (local and LDAP)... Now, when I do a /opt/splunk/bin/splunk apply shcluster-bundle ... I get the following error: Error while deploying apps to target=https://name.xyz:8089 with members=2: no captain found amongst members The internal log is as follows: 127.0.0.1 - admin [02/Mar/2016:11:10:35.265 +0000] "POST /services/apps/deploy HTTP/1.1" 500 245 - - - 10529ms But the SHC looks fine in the Distributed Management Console and I get the following output when checking cluster status on CLI: name1# /opt/splunk/bin/splunk show shcluster-status Captain: dynamic_captain : 1 elected_captain : Wed Mar 2 10:48:04 2016 id : B2542A43-0D49-4235-ABAA-6749581BA6DC initialized_flag : 1 label : name1 maintenance_mode : 0 mgmt_uri : https://name1.xyz:8089 min_peers_joined_flag : 1 rolling_restart_flag : 0 service_ready_flag : 1 Members: name2 label : name2 mgmt_uri : https://name2.xyz:8089 mgmt_uri_alias : https://1.1.1.2:8089 status : Up name3 label : name3 mgmt_uri : https://name3.xyz:8089 mgmt_uri_alias : https://1.1.1.3:8089 status : Up Thanks, /Rainer ... View more

Hello, How can we add custom _meta Tags to AWS Description and Cloudwatch inputs since specialized conf files are used to collect these? I tried to add the _meta command to aws_description_tasks.conf and aws_cloudwatch_logs_tasks.conf, but get an error that this command is not supported. Thanks, Rainer ... View more

Hello, We would like to match all sources except the ones including /splunk/ in props.conf. Example: No match for /opt/splunk/var/log/splunk/metrics.log and /opt/splunk/var/log/splunk/splunkd.log We tried several regex variations, but without luck... Thanks, Rainer ... View more