I was able to successfully install and get the Splunk 7.3.6 forwarder to start on Solaris 10 (Generic_150400-69) by copying the missing C++ library in /usr/sfw to the /opt/splunkforwarder library folder using the following procedures: cp /usr/sfw/lib/sparc9/libstdc++.so.6.0.3 /opt/splunkforwarder/lib cd /opt/splunkforwarder/lib chmod 550 libstdc++.so.6.0.3 chown splunk:splunk libstdc++.so.6.0.3 ln -s libstdc++so.6.0.3 libstdc++.so.6 I suspect this would work on Solaris 11 as well. ... View more

It's not possible to run eval or other such functions at index time. It's really only regex that is possible, and unfortunately unit conversion isn't something that would be possible with regex. One option would be to use another process to modify your data prior to it being made available to Splunk. This could be a scripted or modular input, or even just a cron job. But unfortunately there is not a way to do that type of modification on standard splunk inputs at index time. ... View more