This is the info that I am pulling into Splunk from SharePoint 2019
perfmon
IIS logs
ULS logs
I am storing the IIS and ULS logs in a sharepoint index. I built out a correlation search dashboard so I don't have to use the Merge-SPLogFile cmdlet for PowerShell.
Here are the inputs.conf, props.conf and transforms.conf
IIS
[monitor://L:\inetpub\logs\LogFiles**.log]
index = sharepoint
sourcetype = iis
ignoreOlderThan = 1d
ULS
[monitor://L:\Diagnosticslog]
index = sharepoint
whitelist = .*-\d+-\d+.log$
sourcetype = MSSharePoint:2019:ULSAudit
ignoreOlderThan = 1d
PROPS.CONF
[MSSharePoint:2019:ULSAudit]
SHOULD_LINEMERGE = false
CHECK_FOR_HEADER = false
LINE_BREAKER = ([\r\n]+)\d{2}/\d{2}/\d{4}\s\d{2}:\d{2}:\d{2}.\d{2}\s
TRANSFORMS-ulscomment = uls_remove_comments
SEDCMD-cleanup = s/(...([^*]+).*?...)//g
TRANSFORMS.CONF
[uls_remove_comments]
REGEX = ^Timestamp
DEST_KEY = queue
FORMAT = nullQueue
... View more
I have upgraded to 6.5.1 and am having similar issues. When I get to Setup a show, all of my dashboards show up, but after I choose the dashboards to cycle through and click on Start Show, I just get a blank screen.
I have cleared my cache in both IE and Chrome, used the /en-US/_bump and restarted Splunk, but still am getting the same results.
... View more