Hello, is it possible in Splunk HEC from Kafka to receive raw events on HF in order to parse fields with addons? It seems we can only receive json data with "event" field and may not be able to extract fields within standard addons? The HEC event may also contain target index and sourcetype. Thanks.   ... View more

Hello, I put this regex on SHC inline extraction :  "<(?<pri>\d+)>1\s(?<timestamp>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?[+-]\d{2}:\d{2})\s(?<hostname>[^\s]+)\s(?<appname>[^\s]+)\s(?<procid>[^\s]+)\s(?<msgid>[^\s]+)\s(?<structured_data>\S+)\s(?<json_msg>\{.*\})" however json_msg needs | spath input=json_msg Is it possible to auto extract fields contained in json_msg to avoid adding | spath input=json_msg at search time? Thanks.  ... View more

Hello, we have Windows servers from two environments, we want WinEventLog source (Windows Events logs) to go in "windows" index from main environment and secondary environment to go to "sec_windows". On UF from secondary environment we have setup inputs.conf with index = sec_windows but this doesn't work : all goes to windows index, could you help ? Thank you very much.   props.conf [source::WinEventLog:*] TRANSFORMS-set_index_sec_windows = set_index_sec_windows TRANSFORMS-set_index_windows_wineventlog = set_index_windows_wineventlog transforms.conf # Windows [set_index_windows_wineventlog] SOURCE_KEY = MetaData:Source REGEX = WinEventLog DEST_KEY = _MetaData:Index FORMAT = windows [set_index_sec_windows] SOURCE_KEY = _MetaData:Index REGEX = sec_windows DEST_KEY = _MetaData:Index FORMAT = sec_windows   ... View more