I found that the solution to this is using the syslog-ng syslog() driver instead of the network() driver as your source. Here is an example configuration: source "s_fortigate" { syslog( transport("tcp") port(1514) ); }; template t_msgheader_msg { template("$MSGHDR $MSG\n"); }; destination "d_fortigate" { file("/data/syslog/fortigate.log" owner(splunk) group(splunk) dir_owner(splunk) dir_group(splunk) create_dirs(yes) dir_perm(0770) perm(0660) template(t_msgheader_msg) ); }; log { source("s_fortigate"); destination("d_fortigate"); }; @muradgh @idiota  ... View more

I resolved this error on all of the dashboards at once using the following commands (beware that this will overwrite contents of app "default" dashboards so it will not be an "upgrade-safe" change.  This just means the changes will be overwritten when you upgrade any apps.  I tested this on Splunk 9.0.3 and didn't change any files in the manifest. Please be sure to mark this as the answer if it resolves the issue. perl -pi -e 's/<form(?=[ >])((?:(?:[^>]| )(?!version="1\.1"))*>)/<form version="1.1"\1/' /opt/splunk/etc/apps/*/*/data/ui/views/*.xml perl -pi -e 's/<dashboard(?=[ >])((?:(?:[^>]| )(?!version="1\.1"))*>)/<dashboard version="1.1"\1/' /opt/splunk/etc/apps/*/*/data/ui/views/*.xml   ... View more

Not to revive this old thread, but to folks who visit this later with a similar question, the following app will do what OP is asking for: https://splunkbase.splunk.com/app/5237/ ... View more

We published an app this week that includes functionality to backup and restore your KV Store collections. Check it out: https://splunkbase.splunk.com/app/3536/#/details ... View more

This basically says if the phone number is 10 or 11 digits, perform the regular expression match and preserve only the digits you are looking for. In your example, a field extractor would probably work just as well, but this gives you a little more flexibility I think. On second glance, it looks like a character was missing from my initial response, so try this instead: if(len(phone_number)>=10 and len(phone_number)<=12,replace(phone_number, "^\+?1?(\d{3})\d{7}$","\1")) This will take care of handling the + operator as well. The field extractor version of this regular expression would be something like: \+?1?(?P<area_code>\d{3})\d{7} ... View more

Try a calculated field. Settings -> Fields -> Calculated Fields if(len(phone_number)==10 or len(phone_number)==11,replace(phone_number, "^1?(\d{3})\d{7}$","\1")) You will have to associate it with your target source, sourcetype, or host, as well as the target app. Might have to mess with the regular expression and matched field length to include the + sign. -- J.R. Murray MetaNet IVS ... View more