Hello splunker, I have some trouble to forward data to third-party systems via syslog. All logs are forwarded via syslog except one where parameter INDEXED_EXTRACTIONS is set on a uf. I share my configuration to explaint you my problem : UF : inputs : [monitor://c:\tmp\logs.csv] sourcetype = fileshared props: [fileshared] KV_MODE=none INDEXED_EXTRACTIONS=csv INDEXER : props: [fileshared] TRANSFORMS-syslog = send_to_syslog transfoms: [send_to_syslog] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = my_syslog_group outputs: [syslog:my_syslog_group] server = loghost.example.com:514 Logs with sourcetype fileshared are indexed as expected (fields and logs indexed) but there are not forwarded via syslog All others logs from this uf without INDEXED_EXTRACTIONS parameter are indexed and forwarded via syslog On Splunk documentation, I see that : When you forward structured data to an indexer, it is not parsed when it arrives at the indexer, even if you have configured props.conf on that indexer with INDEXED_EXTRACTIONS. Forwarded data skips the following pipelines on the indexer, which precludes any parsing of that data on the indexer: I understand that Is not possible to set parsing and transformation on indexer for sourcetype with INDEXED_EXTRACTION paramater . Do you know if there is a way to forward this kind of data without another method ? Thanks for your help, Regards, ... View more

Hello Splunkers, I would like to know if there is any way to increase the queue of my syslog group. I mean, currently I forward logs that are received on my Splunk through a tierce solution on syslog and the default queue is 97 KB. Please find below an example : INFO Metrics - group=queue, name=my_syslog_group, max_size_kb=97, current_size_kb=0, current_size_kb=0, largest_size=0, smallest_size=0 I tried to set up this configuration on server.conf : [queue] maxSize = 10MB [queue:my_syslog_group] maxSize = 10MB After restarting, I have always the default queue (97 KB). I saw nothing in the outputs.conf file to increase this queue for syslog output. Do you have any idea ? Thx for your help, Regards, Ludo ... View more

Hi all, I'd like to keep value on a field until the value of this field changes. Please see the following example: Explanation: I have: 9/25/14 2:05:55.000, PM field1=abc, field2=abc2, field3=xyz3 9/25/14 2:05:54.000, PM field1=abc, field2=def2 9/25/14 2:05:53.000, PM field1=abc, field2=ghi2 9/25/14 2:05:52.000, PM field1=jkl, field2=mno2, field3=vw3 9/25/14 2:05:51.000, PM field1=jkl, field2=pqr2 9/25/14 2:05:50.000, PM field1=jkl, field2=stu2 9/25/14 2:05:49.000, PM field1=test, field2=tst2, field3=tre3 9/25/14 2:05:48.000, PM field1=test, field2=psq2 9/25/14 2:05:47.000, PM field1=test, field2=aaz2 I would like to do 9/25/14 2:05:55.000, PM field1=abc, field2=abc2, field3=xyz3 9/25/14 2:05:54.000, PM field1=abc, field2=def2, field3=xyz3 9/25/14 2:05:53.000, PM field1=abc, field2=ghi2, field3=xyz3 9/25/14 2:05:52.000, PM field1=jkl, field2=mno2, field3=vw3 9/25/14 2:05:51.000, PM field1=jkl, field2=pqr2, field3=vw3 9/25/14 2:05:50.000, PM field1=jkl, field2=stu2, field3=vw3 9/25/14 2:05:49.000, PM field1=test, field2=tst2, field3=tre3 9/25/14 2:05:48.000, PM field1=test, field2=psq2, field3=tre3 9/25/14 2:05:47.000, PM field1=test, field2=aaz2, field3=tre3 Would anyone have any idea? Thanks a lot for your help, Regards, Ludovic ... View more