Hi All, As indicated here (https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-monitor-SPLUNK-HOME-var-log-splunk-audit-log/m-p/506185#M86203), I have been able to get the audit.log from our Universal Forwarders with audittrail sourcetype. Unfortunately sometimes those events read from $SPLUNK_HOME/var/log/splunk/audit.log are merged in a unique event (even if each event is in a new line and starts with a timestamp). In our deployment we have Universal Forwarders sending data to Heavy Forwarders that then send them to Indexers: UF --> HF --> IDX What I tried to do is to deploy a props.conf on the HF to indicate the following:   [audittrail] SHOULD_LINEMERGE = false SEDCMD = s/\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}.* INFO AuditLogger - //g   But even the SEDCMD is not applied. And I can see with the following command that the configuration are properly read in the HF:   splunk btool props list --debug   Due to that I tried adding this props.conf directly on the UF and it is working (but it is not a good solution for us because we don't want to force the local processing on the UF).   [audittrail] SHOULD_LINEMERGE = false SEDCMD = s/\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}.* INFO AuditLogger - //g force_local_processing = true   I believe the issue is related to the fact that the audit logs from UF are sent to HF indexQueue instead of parsingQueue.  I tried also to add the audit.conf file both in UF and HF as follow without any luck:   [default] queueing=false   Reading further on Splunk documentation (https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Auditconf) :   queueing = <boolean> * Whether or not audit events are sent to the indexQueue. * If set to "true", audit events are sent to the indexQueue. * If set to "false", you must add an inputs.conf stanza to tail the audit log for the events reach your index. * Default: true   My questions are: Do you know what does it means "If set to "false", you must add an inputs.conf stanza to tail the audit log for the events reach your index." Do you have any idea on how to apply on the HF the props.conf to the audit events coming from the UF without having to deploy it directly on UF with  force_local_processing=true Thanks a lot, Edoardo   ... View more

Hi all, In the middle of a search, I have two string fields, one is called A and the other B (both have the ";" as delimiter but the number of values inside is variable): A=test;sample;example B=test;sample;example;check I would like to compare the two string and have the difference as result in a new field called C (so suppose C=check). Is there any way to achieve that (like doing an Excel VLOOKUP without performing a sub-search that can affect the search performance)? Thanks a lot, Edoardo ... View more