Hi All, I have a few existing inputs with EventGen (v6.5.2) and they work perfectly on Splunk 8.0.5. The use case I am having trouble with is where: a) The timestamp is not contained in the _raw data (the actual Production input uses the current index time) b) There are other timestamps in _raw (they are not related to _time, are separate fields). c) All events in the csv sample file must be ingested each interval.   I have tried both sample mode and replay mode. Sample mode ingests the data but identifies different date/time values in _raw and uses that as _time, which is unexpected. This is even while autotimestamp = false.   In replay mode, nothing is ingested due to errors where it can't find the timeField (there is a time column in the csv that I referenced).   So how can I ingest all events in the sample csv file while ensuring _time is the current time, and not dependent on any timestamps in the _raw?   Here is my config for mode = sample.   [ops_724events_ggprocdetail_sample] disabled = false mode = sample interval = 60 sampletype = csv autotimestamp=false earliest = -1m latest = now   Csv sample file has the following columns: time,index,host,source,sourcetype,"_raw" ... View more

We have setup "enable boot-start" as the non-root user "splunk" and it's not systemd managed: /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 --no-prompt --accept-license --answer-yes From what I have read, this changes the SPLUNK_OS_USER in splunk-launch.conf, as well as creates a new init.d script. However, according to this document, you still need to edit the init.d script to run splunkd as a non-root user. I would have thought that specifying "-user splunk" would have been enough to ensure this happened. So can you please verify that, in order to properly run splunk as non-root user and for splunk to start at boot, you need to: Enable boot-start as per the command above; Edit the init.d script to ensure that the commands are being run as the appropriate non-root user. I ask this because this makes maintenance a bit more tricky. Say I want to disable boot-start. This deletes the init.d script apparently. Then when we run the enable boot-start command again, the file is re-created, without our edits. So we need to edit the file again. Failing to do so could cause issues when splunk is started on boot as root rather than the non-root user. ... View more