You could send your log to the Splunk Http Event Collector (HEC). curl to HEC; you can send raw or JSON. ... View more

sourcetype=iis your_field::* OR your_field2::* ... I am able to list all fields/columns from the index fieldsummary keeps search time extract fields also. ... View more

use code sample and check your sample before ask the question. your log is wrong and some missing string.(where is [ vs ,JVM_memor] ? ) ... View more

Thanks! I had seen that post, but Splunk support did not want to provide me with the 0GB/day license that enables KV Store. They kept telling to contact the developer of the Add-on and that they didn't support it. That using the Forwarder Group license should be all I need. I did, in my haste, try the Free License and that worked. Finally support suggested I copy the enterprise 0GB/day license they provided 2 years ago on another heavy forwarder to this one and that worked too (I should have thought about that before them). Not sure why this add-on is not working with the normal Forwarder Group License on a Heavy Forwarder, I feel like it should. ... View more

Thanks! I wish I could accept both answers. ... View more

Thanks! It just occurred to me that "max" might work and looking back here you confirmed. Thanks, for your help! ... View more

Your description is strange to me. If you mean that there is a blank line between events, then this will do it: [<YourSourcetypeHere>] SHOULD_LINEMERGE = false LINEBREAKER = ([\r\n]\s*[\r\n]+) ... View more

I saw this post... https://answers.splunk.com/answers/712405/splunk-add-on-for-o365.html That states the O365PortalError: 401:{"error":{"code":"AF10001","message":"The permission set () sent in the request does not include the expected permission."}} message is given if the optional DLP permissions are not granted. I'm getting the same error and seeing no data. Right now I'm just trying to pull SharePoint Online audit data and have granted the following permissions. Office 365 Management APIs (4) ActivityFeed.Read | Delegated |Read activity data for your organization | Yes |Granted for XXXX ActivityReports.Read | Delegated | Read activity reports for your organization | Yes | Granted for XXXX ActivityReports.Read | Delegated | Read activity reports for your organization | Yes | Granted for XXXX ServiceHealth.Read | Delegated | Read service health information for your organization | Yes | Granted for XXX EDIT: We fixed this and have data now; we missed applying the API permissions to the "Application Permissions" for the registered app and had only granted "Delegated Permissions" ... View more

Thanks. I'll have to explore that option. I have the add-on installed on my Azure heavy now... ... View more