Hello, I'm continuously experiencing several error messages in splunkd.log such as: ERROR BucketMover - Unable to parse bucket ID from path="..." In this forum I only found previous solutions saying like "This issue has been fixed in version 6.x" - but I'm currently on 7.2.0 Should I be concerned about these messages? Would this error affect my data retention? And finally - how could the issue be fixed? Regards, Bernd ... View more

Hi, what would be the best practice for avoiding that a recent log line like the following one would be wrongly tagged as coming from two years ago? Jun 23 23:15:47 cisco123.mylocal.net Compiled Fri 20-Oct-17 20:51 by prod_rel_team current sourcetype: cisco:ios _time: 2017-10-20T23:15:47.000 My plan would be setting a specific subtype and disabling the timestamp processor for that particular case. transforms.conf: [set_subtype_compiled_message] REGEX = Compiled\s\w+\s\d+-\w+-\d+\s\d+:\d+\sby DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype:cisco:ios_compiled props.conf: [cisco:ios] TRANSFORMS-set_subtype_compiled_message [cisco:ios_compiled] DATETIME_CONFIG = NONE Any better ideas, pros and cons? Regards, Bernd ... View more