This also worked for my case, exactly the same issue as you described. It was key to put the props.conf with the CHARSET on both the UF and the indexer, otherwise, it didn't work. ... View more

We had a similar problem as joelshprentz, and the above suggestion didn't end up working. Here's a similar thread regarding this same issue: http://answers.splunk.com/answers/125955/3rd-party-syslog-server-recieved-the-strange-messages-from-uf.html We had to use the syslog forwarding method to not also get the heartbeat messages (disclaimer: I was doing the forwarding from a Heavy Forwarder, so the syslog forward method works perfectly in that scenario): outputs.conf [syslog:target_group] server = host:port type = tcp props.conf [spec] TRANSFORMS-syslog=unique_name transforms.conf [unique_name] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = target_group The above is what worked for us. Good luck. ... View more

Downloaded this app and have it running on a Windows machine. Is anyone else getting this error at runtime: Unhandled exception: Cannot print exception string because Exception.ToString() failed. After getting this error, the app stops working, and I'm not able to see the data input option for O365. Thanks in advance. ... View more

Just found this similar post, apparently it's a known bug in Splunkv6: http://answers.splunk.com/answers/109473/alt-click-not-working-selected-fields ... View more