Hello, I have some difficulties to ingest properly logs from rotated file, where the rotation is fully handled by an application, without any settings about its log files. In some cases, it rotates the log file in the middle of an event, and before the timestamp. Like this: file.log.1 [category][event][reason][host][timestamp]... [category][event][reason][host][timestamp]... [category][event][reason] Note: there is no new line or carriage return at tne end of the file file.log [host][timestamp]... [category][event][reason][host][timestamp]... [category][event][reason][host][timestamp]... I have some events with an additional line in plain text (no brackets), so at first I let the line merger do its job, but for the splitted line between the 2 log files, it does not work as the first line does not contain the timestamp, and it is added to the previous event. So, I disabled line merging and started to build a line breaker, resulting in this: (?:\[[^]]*\][\r\n]*){24}\[[^]]*\](?:[^\[\]]*)([\r\n]+) This is because the log line is made of 25 blocks between brackets, and optionally a second line. It works very good on a test file when the splitted line is in the same file, but once the 2 parts of the line are in different files ... it does not work anymore 😞 Do you have any advice on how I could handle that ? ... View more

Hello, I see that Linux kernel 2.6 is deprecated since 1 year (on April 2018, with Splunk 7.1.0). https://docs.splunk.com/Documentation/Splunk/7.1.0/ReleaseNotes/Deprecatedfeatures#Platform_support I would like to know which future version of Splunk will "remove" this kernel version, and if there is an estimated release date. Regards, Christophe ... View more

Hello All, We have a clustered environment in multi-site running Splunk 6.6 and we would like to upgrade it to 7.2. I see in the documentation that a site-by-site would be possible only in 3 steps (6.6 to 7.0, then 7.0 to 7.1, then 7.1 to 7.2). I assume that the "no more than one sequential n.n version" is required for the replication step in the middle of the process when the first site is upgraded and not the second yet. Then, could it be possible to "skip" some versions and do something like this: Step 0, initial situation: - Site1 : 6.6 - Site2 : 6.6 Step 1, ugprade Site1 to its next version: - Site1 : 7.0 - Site2 : 6.6 Step 2, upgrade Site2 to the next version of Site1: - Site1 : 7.0 - Site2 : 7.1 Step 3, upgrade Site1 to the next version of Site2: - Site1 : 7.2 - Site2 : 7.1 Step 4, last upgrade of Site2: - Site1 : 7.2 - Site2 : 7.2 You can notice that at no time is there more than 1 difference version, so replication should work at my steps 2 and 3. Is there someone who has already tested this? Regards, Christophe ... View more

Hello, I'm trying to configure Proxy SSO authentication, with PingAccess, for Splunk Enterprise v7.2.5.1. But whatever I try and configure on Splunk side, I obtain this message in the splunkd logs : DEBUG UiAuth - Value of header returned=<user id> INFO UiAuth - ProxySSO authType not configured, no groups header processing ERROR UiAuth - user=<user id> action=login status=failure reason=sso-failed useragent="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.91 Safari/537.36" clientip=<proxy sso ip> Here is my authentication.conf file: [authentication] authType = ProxySSO [roleMap_proxySSO] user_0 = P_SPLUNK_CONSULT-DATA-ALL_PUBLIC user_1 = P_SPLUNK_CONSULT-DATA-IT_INTERNE user_2 = P_SPLUNK_CONSULT-DATA-IT_CONFIDENT admin = pg_splunk And my web.conf file: [settings] SSOMode = permissive trustedIP = 127.0.0.1,<proxy sso ip> remoteUser = REMOTE_USER remoteGroups = REMOTE_GROUPS remoteGroupsQuoted = false allowSsoWithoutChangingServerConf = 1 enableSplunkWebSSL = 0 enableWebDebug = true The SSO debug page looks well, but the line "Value of REMOTE_GROUPS" remains empty (the user is ok). And at the bottom of the page, in the "other http headers", there is the header "REMOTE_GROUPS" which contains the right list of groups, separated by commas, without quotes. According to the groups list and the group mapping rules, the user should obtain the first 3 roles (user_0, user_1, user_2). What did I miss ?? Christophe ... View more