When it show "all" results it seams you have in one or more 'by' fields differences.
Put everything expect IP in latest() in front of the 'by' and this should be what you are searching for.
... View more
Hi,
In your description is the inputs missing:
You are searching for '_TCP_ROUTING ='
See also:
the docs for outputs.conf (the last example) and the inputs.conf
Kind Regards
Darth
... View more
Hi,
I would concentrate my search for the date_* fields also stats and eval functions.
Without example data I can't figure out all possibilities.
Kind Regards
Darth
... View more
rex "dv_state=\"(?<dv_state>[^\"]*)\""
Regular Expressions is a Language for it's own... there are many good creators for that.
online I often use regexr(dot)com
On Mac is regExRX a good choice
Kind regards
Darth
... View more
Hi,
A customer of my company has round about 70 indexes on a single node splunk enterprise indexer, without index numbers indicated problems. Almost the same count on a Cluster too.
Think 100 for a Cluster shouldn't be a problem.
Maybe you have to configure the size. Every index has in standard config a size of 500 GB.
Kind Regards
Darth
... View more
Hi
uncompressed tar files with suffix .diag are working
compressed tar files with suffix .diag are NOT working
following error message occurs in splunkd.log when it's gziped:
11-10-2016 09:50:12.793 +0100 WARN FileClassifierManager - The file '/opt/splunk/blub.diag' is invalid. Reason: binary
Kind Regards
Darth
... View more
Hi
This features should only work with a non-standard admin password on Universal Forwarder.
You can change it with the CLI command like:
./splunk edit user admin -password 'S3cret-1'
Kind Regards
Darth
... View more