Hi, I created props and transforms files to put source value of file in raw event. I am sending these event to third party app. I am using heavy forwarder. But ı need to replace "/",":"(non-alphanumeric) with "_" . Is there any way to replace char in source field with transforms.conf ? I saw CLEAN_KEYS but this attribute is only valid for search-time field extractions. Props: [mysource] DATETIME_CONFIG = CURRENT category = Custom pulldown_type = 1 TRANSFORMS-EYI_Transform = e_source CHARSET = AUTO [e_source] SOURCE_KEY = MetaData:Source REGEX = ^source::(.*)$ FORMAT = filepath$1filepath$0 DEST_KEY = _raw Event look like : filepathD:\inetpub\LocalUser\MYFILE.TXTfilepath\xE1\xEC\xEB\x8C\x00\x00\x8C\x00\x0030.09.201601.01.0001x \x00NNYNNSAYX SAYX 2016-12-06-11.29.05.4154172016-12-06-13.09.42.541869\x00\x00\x00 Event should look like : filepathD__inetpub_LocalUser_MYFILE.TXTfilepath\xE1\xEC\xEB\x8C\x00\x00\x8C\x00\x0030.09.201601.01.0001x \x00NNYNNSAYX SAYX 2016-12-06-11.29.05.4154172016-12-06-13.09.42.541869\x00\x00\x00 ... View more

Hi, Following the Documentation provided by splunk I triggered streamfwd from the command line for my pcap. http://docs.splunk.com/Documentation/StreamApp/6.1.1/DeployStreamApp/streamfwdcommandlineoptions I searched "alltime" but i couldn't see any event about my pcap on search app. How can we search old pcap events? App : App For Stream 6.6.1 streamfwd logs: C:\Program Files\Splunk\etc\apps\Splunk_TA_stream\windows_x86_64\bin>streamfwd.exe -r test4.pcap 15:16:17.624 INFO stream.CaptureServer - Found DataDirectory: C:/Program Files\Splunk\etc\apps\Splunk_TA_stream\data 15:16:17.633 INFO stream.CaptureServer - Found UIDirectory: C:/Program Files\Splunk\etc\apps\Splunk_TA_stream\ui 15:16:18.956 INFO stream.StreamSender - Successfully pinged server (config needs update): cb807f08-8b58-42c8-84d3-42a2602a0fc0 15:16:18.969 INFO stream.CaptureServer - Default configuration directory: C:/Program Files\Splunk\etc\apps\Splunk_TA_stream\default 15:16:18.984 INFO stream.CaptureServer - Start sending pcap data 15:16:19.996 INFO stream.StreamSender - Successfully pinged server (config needs update): cb807f08-8b58-42c8-84d3-2a2602a0fc0 15:16:22.058 INFO stream.CaptureServer - Configuring offline capture with pcapfile C:/Program Files\Splunk\etc\apps\Splunk_TA_stream\windows_x86_64\bin\test4.pcap 15:16:22.075 INFO stream.CaptureServer - Starting data capture 15:16:22.089 INFO stream.main - streamfwd has started successfully (version 6.6.1 build 159) 15:16:22.337 INFO stream.CaptureServer - Finished sending pcap data; shutting down 15:16:22.345 INFO stream.main - streamfwd is shutting down C:\Program Files\Splunk\etc\apps\Splunk_TA_stream\windows_x86_64\bin> And also i tried below command but ı couldnt see anything... C:\Program Files\Splunk\etc\apps\Splunk_TA_stream\windows_x86_64\bin>streamfwd.exe -r "C:\Program Files\Splunk\etc\apps\Splunk_TA_stream\windows_x86_64\bin\test4.pcap" -s localhost:8889 -b 1048576 --repeat 15:21:02.301 INFO stream.CaptureServer - Found DataDirectory: C:/Program Files\Splunk\etc\apps\Splunk_TA_stream\data 15:21:02.310 INFO stream.CaptureServer - Found UIDirectory: C:/Program Files\Splunk\etc\apps\Splunk_TA_stream\ui 15:21:03.624 INFO stream.StreamSender - Successfully pinged server (config needs update): f956a995-c651-4d5f-a458-0c1608db0003 15:21:03.634 INFO stream.CaptureServer - Default configuration directory: C:/Program Files\Splunk\etc\apps\Splunk_TA_stream\default 15:21:03.648 INFO stream.CaptureServer - Start sending pcap data 15:21:04.660 INFO stream.StreamSender - Successfully pinged server (config needs update): f956a995-c651-4d5f-a458-0c1608db0003 15:21:06.714 INFO stream.CaptureServer - Configuring offline capture with pcapfile C:/Program Files\Splunk\etc\apps\Splunk_TA_stream\windows_x86_64\bin\test4.pcap 15:21:06.731 INFO stream.CaptureServer - Starting data capture 15:21:06.747 INFO stream.main - streamfwd has started successfully (version 6.6.1 build 159) 15:21:10.246 INFO stream.StreamSender - Successfully pinged server (config up to date): f956a995-c651-4d5f-a458-0c1608db0003 15:21:16.015 INFO stream.StreamSender - Successfully pinged server (config up to date): f956a995-c651-4d5f-a458-0c1608db0003 15:21:21.040 INFO stream.StreamSender - Successfully pinged server (config up to date): f956a995-c651-4d5f-a458-0c1608db0003 15:21:29.143 INFO stream.StreamSender - Successfully pinged server (config up to date): f956a995-c651-4d5f-a458-0c1608db0003 Logs seem good. ... View more

Hi, I am testing "App For Stream" App(6.6.1) to capture https traffics. I added pem file to keystore.db as descr. belowlink http://docs.splunk.com/Documentation/StreamApp/6.6.1/DeployStreamApp/EnableSSLforStreamForwarder But i am getting errors in streamfwd.log. (DSSL library error code -41) Error line: 2016-10-17 17:37:02 WARN 11592 stream.SnifferReactor - SSL decryption error (DSSL library error code -41) (ssl) [c=yyyyyyy:61914, s=xxxxxx:8282] Anyone can help me? Thanks ... View more

Hi, I want to add hostname or host IP to the head of each row before forwarding. Is it possible with transforms.conf? Can a Splunk forwarder learn and set host info to any token so we can use it conf files? example raw log : 06-07-2016 14:44:18.878 +0300 INFO Blablabal - Msgmsgmsgmsgmsgm 06-07-2016 14:44:20.754 +0300 WARN Blablsaeccl - Msgmsgm dasas After transform: HOSTNAME 06-07-2016 14:44:18.878 +0300 INFO Blablabal - Msgmsgmsgmsgmsgm HOSTNAME 06-07-2016 14:44:20.754 +0300 WARN Blablsaeccl - Msgmsgm dasas or xx.xxx.xx.xx 06-07-2016 14:44:18.878 +0300 INFO Blablabal - Msgmsgmsgmsgmsgm xx.xxx.xx.xx 06-07-2016 14:44:20.754 +0300 WARN Blablsaeccl - Msgmsgm dasas Thanks. ... View more