@arunsunny  Did you find a config for send traps to diff logs files? ... View more

Hi, did you find any viable solution to this problem ? ... View more

@arunsunny - Here is my understanding about a primary copy of a bucket from Consultant Training. The search head always sends search requests to all the indexers (peers) to all the sites regardless of single-site or multi-site, regardless of affinity enabled or not. The primary bucket is how Splunk decides which bucket needs to be searched. If there is more than one primary bucket means duplicate data in the search results. There could be multiple searchable copies of a bucket but there will be only one primary bucket. That's how Splunk ensures no duplicate data in the results.   I hope this helps!!! ... View more

Splunk will put one copy on the original site and the other copy on the other site. ... View more

Hi @lguinn2 , I liked the above answer. I have one requirement where have 3 sites and planning to keep to search factor. Current Config: [clustering] site_search_factor = origin:1,site1:1,site2:1,site3:1,total:3   To making into 2 Search Factor in any sites will the below settings works? [clustering] site_search_factor = origin:1,site1:1,site2:1,site3:1,total:2             ... View more

Hey @povares_splunk Splunk_TA_microsoft-cloudservices/bin/splunktamscs/ca_certs_locater.py TEMP_CERT_FILE_NAME = 'httplib2_merged_certificates_{}.crt' Whenever the inputs run this script creates the cert file under /tmp/ directory and it will never get deleted and making /tmp/ directory full. Is this a bug with the App?  OR It's required to create a cert file while running inputs?   Regards, Arun Sunny  ... View more

I'm creating a table using Splunk query index=student sourcetype=student_details | table Col1 Col2 OnlineTeslink ... View more

If you are referring to the json formatting and field extraction, just add: INDEXED_EXTRACTIONS=json KV_MODE=none ... View more

Can we use a wildcard something like below? [source::*] [host::] [] ... View more

yeah thus why i have two different sourcetype for a source. But you mentioned that it is writing to only one sourcetype. May be you can try one with _TCP_ROUTING and another with _SYSLOG_ROUTING. Check the below link, http://docs.splunk.com/Documentation/Splunk/6.6.2/Forwarding/Routeandfilterdatad Topic: Replicate a subset of data to a third-party system ... View more

Thank you, Woodcock !! ... View more

Sounds like a new question, so please create one. While you do that, also test if your calcfield works. ... View more

I don't know why my inputs-file change gets picked up immediately... On V2 it does, that's the reason we migrated from V1. That reload call didn't work for us, and restarting the splunk server locally was the only option. But it is annoying as we have DBA's maintaining the DB Connect app contents; and now we have to set/change their queries in config files. Why did they implement this 0 Result issue that V1 didn't have... Glad you have a work around though! 😉 ... View more

Try defining the precision offset in your XML. <option name="numberPrecision">0.00</option> ... View more

Hi All, Facing few challlenges, mine is playing around with the same transforms. I'm trying to achieve the same source data to forward to two different logical indexes and two different indexes groups. Below is my senrio. In props.conf used [source::Dual_Data_Testing] TRANSFORMS-source = Stan1, Stan2 In transforms.conf [Stan1] SOURCE_KEY = MetaData:Source REGEX = . DEST_KEY = _MetaData:Index FORMAT = Index1 DEST_KEY = _TCP_ROUTING FORMAT = IndexerGroup1 [Stan2] SOURCE_KEY = MetaData:Source REGEX = . DEST_KEY = _MetaData:Index FORMAT = Index2 DEST_KEY = _TCP_ROUTING FORMAT = IndexerGroup2 Currently the above conf is not working. Please any suggestion can we workaround for this ? Thanks, Arun Sunny ... View more

Use the below two .conf on the source where you are trying to send data !!!! inputs.conf [monitor:///app/logs/work/*] sourcetype = work index = test1 outputs.conf [tcpout] defaultGroup=indexerGroup1,indexerGroup2 [tcpout:indexerGroup1] server=server1:9997 [tcpout:indexerGroup2] server=server2:9997 At the receiver side have the below configuration. inputs.conf [splunktcp://9997] [splunktcp://9997] _TCP_ROUTING=indexerGroup1 [splunktcp://9997] _TCP_ROUTING=indexerGroup2 Regards, Arun ... View more