Hye. The situation :  an instance of Splunk standalone (test platform), and an UF. The data : JSON Stream with multi level. The problem : the volume of data being important, we would like to reduce the _raw at only one field. But all JSON fields are saved as _meta. We have succeeded to update source, sourcetype and host from the JSON datas. But impossible to omit _meta ... (they always appear in the Search Head) IN :  { "input":{      "type":"log"}, "log":{      "file":"c:\log.josn"}, "@metadata":{      "beat":"filebeat",      "version":"7.10.2"}, "message":"bla bla bla", "fields":{      "type":"bdc",      "host":"VLCR03",      "type2":"back"} } OUT :  _raw  : "bla bla bla" <= OK meta "input.***" <= to suppress meta "log.***" <= to suppress meta "@metadata.beat" <= to keep meta "@metadata.version"<= to suppress meta "message"<= to suppress meta "fields.***" <= to suppress props.conf on the UF SHOULD_LINEMERGE = false NO_BINARY_CHECK = true CHARSET = AUTO KV_MODE = none AUTO_KV_JSON = false INDEXED_EXTRACTIONS = JSON TRANSFORMS-x = set_host set_source set_sourcetype TRANSFORMS-y = extract_message TRANSFORMS-z = remove_metadata transforms.conf on the UF [extract_message] SOURCE_KEY = field:message REGEX = (.*) FORMAT = $1 DEST_KEY = _raw [set_host] SOURCE_KEY = field:fields.host REGEX = (.*) FORMAT = host::$1 DEST_KEY = MetaData:Host [set_source] SOURCE_KEY = field:log.file REGEX = (.*) FORMAT = source::$1 DEST_KEY = MetaData:Source [set_sourcetype] SOURCE_KEY = fields:fields.type,fields.type2 REGEX = (.*)\s(.*) FORMAT = sourcetype::$1:$2 DEST_KEY = MetaData:Sourcetype [remove_message] SOURCE_KEY = _meta:message REGEX = (.*) DEST_KEY = queue FORMAT = nullQueue ... View more

Hello. It is not a question, it is a use case that I don't arrive to resolve. The situation : a log file on remote server, with a Splunk Universal Forwarder and only an inputs.conf (not other conf) a props.conf on Heavy Forwarder with LINE_BREAKER = \d{1,4}-\d{1,2}-\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}(,|.)\d{1,3}\s\[ The default format : 2020-12-07 08:02:24.350 [<thread>] <type> <bla bla bla ...> When the record is a Java Exception logging, there is no problem. The record is complete and contain all the stacktrace (SHOULD_LINEMERGE = TRUE) But I have other cases which group together a whole set of lines. And each time, the first line contains the word "started", and the last the word "ended". For example, this is for Splunk only one log. But I would like 4 !       2020-12-07 08:02:30,567 [http-nio-10.108.181.36-30000-exec-6] INFO p.a.f.s.w.FrontalAuthentRestController 869 - - b- health-check started. (FrontalAuthentRestController.java:37) 2020-12-07 08:02:30,583 [http-nio-10.108.181.36-30000-exec-6] INFO p.a.f.s.w.FrontalAuthentRestController 869 - - b- health-check ended. (FrontalAuthentRestController.java:44) 2020-12-07 08:02:34,670 [http-nio-10.108.181.36-30000-exec-9] INFO p.a.f.s.w.FrontalAuthentRestController 845 - - b- health-check started. (FrontalAuthentRestController.java:37) 2020-12-07 08:02:34,684 [http-nio-10.108.181.36-30000-exec-9] INFO p.a.f.s.w.FrontalAuthentRestController 845 - - b- health-check ended. (FrontalAuthentRestController.java:44)       I find the same problem with "proxy started" / "proxy ended", or "doFilter started" / "doFilter ended"... Each time, Splunk gathers the recordings into one       2020-12-07 08:01:43,430 [http-nio-10.108.181.35-30000-exec-3] INFO p.a.f - proxy started. (Proxy.java:106) 2020-12-07 08:01:43,433 [http-nio-10.108.181.35-30000-exec-3] INFO p.a.f. - IDPART = // NUINPE = (Proxy.java:108) 2020-12-07 08:01:43,443 [http-nio-10.108.181.35-30000-exec-3] INFO p.a.f - /3 (ProxyHelper.java:49) 2020-12-07 08:01:43,444 [http-nio-10.108.181.35-30000-exec-3] INFO p.a.f. - /3 (Proxy.java:114) 2020-12-07 08:01:43,907 [http-nio-10.108.181.35-30000-exec-3] INFO p.a.f - proxy ended. (Proxy.java:124)       Do you have an idea ? ... View more

Hye. I installed the plugin on Search Head, and PhantomJS in the /bin directory as describe. When I want to do the setup, there are : a http 303 => "GET /fr-FR/manager/smart_exporter_app/apps/local/smart_exporter_app/setup?action=edit HTTP/1.1" 303 followed by a 404 => "GET /fr-FR/manager/smart_exporter_app/apps/local/smart_exporter_app?msgid=6200000.015878963048 HTTP/1.1" 404 Smart PDF Exporter 1.0.2 Splunk Enterprise 7.0.2 ... View more