I'm at a loss and hoping for an assist.  Running a distributed Splunk instance, I used the Deployment Server to push props.conf and transforms.conf to my heavy forwarders to drop specific external customer logs logs at the HF.    We're receiving logs from several external customers, each with their own index. I'm in progress of dividing each customer into sub indexes like {customer}-network, {customer}-authentication and {customer}-syslog Yes, I'm trying to dump all Linux syslog. This a temporary move while their syslog are flooding millions of errors before we're able to finish moving them to their new {customer}-syslog index. I did inform them and they're working it, with no ETA. I've been over a dozen posts on the boards, I've asked two different AI's how to do this backwards and forwards, I've triple checked spelling, placement & permissions. I tried pushing the configs to the indexers from the cluster manager and that didn't work either. I created copies of the configs in ~/etc/system/local/ and no dice.  I've done similar in my lab with success.  I verified the customer inputs.conf is declaring the sourcetype as linux_messages_syslog I'm at a total loss of why this isn't working.   props.conf: [linux_messages_syslog] TRANSFORMS-dropLog = dropLog transforms.conf: [dropLog] REGEX = (?s)^.*$ DEST_KEY = queue FORMAT = nullQueue   Anyone have any idea what got'cha I'm getting got by? ... View more

I've never worked with splunk regex before so I'm probably just missing something.  I've been up and down  the  https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides and https://docs.splunk.com/Documentation/SCS/latest/SearchReference/RexCommandOverview pages.  All i'm trying to do is set up some regex for a props/transforms that finds any instance of "ssh" and changes it's sourcetype to "authentication" My search: index=accounting sourcetype=linux_admin | rex field=_raw "(?<ssh>\bssh\b)"  Scoped down to the last 60 minutes, I'm getting 2,700 results and none of them have anything to do with ssh. When I run  "index=accounting sourcetype=linux_admin ssh" - which gives the results I'm actually looking for... I only get 28 results and they're all pertaining to ssh.    What am I missing?    Thanks for the input!! ... View more

In Indexes.conf from the CM, I tried to set thawedHomePath to a volume, which I have since learned does not work. I set the path from volume:cold back to $SPLUNK_DB, but no matter what I do the indexer will not acknowledge that I changed it back. It still thinks it's set to the volume. I modified it, commented it  out, deleted the whole indexes.conf file and loaded a manual one in the `/etc/system/local/indxes.conf  and nothing will un-stick it. Every time I start the indexer, the logs show it won't start because thawedHomePath is mapped to a volume still. When I run ~\splunk btool indexes list --debug  it shows the thawedHomePath in question is configured correctly. Has anyone ever experienced this before? Any suggestions on how to get it to accept the change?  Running Splunk 9.2 on RHEL 8 with 1 CM and 2 IDXs clustered together. Fairly new deployment, still working the bugs out. ... View more