What works for us. We have a SHD cluster and authentication is provided by ADFS SSO. For every query, add quotes around action=log* .. For some reason, splunk is NOT detecting action = login attempt as a key-value pair ... may be because there is a space ? ... Example: index=_audit sourcetype=audit user=* "action=log*" The above works! ... View more

Stanza names in props.conf aren't normal regexes. Here are the rules: When setting a [ ] stanza, you can use the following regex-type syntax: ... recurses through directories * matches anything but / 0 or more times | is equivalent to 'or' ( ) are used to limit scope of | So [syslog|linux_secure] should work. This is either a bug in the code, or an error in the documentation. Question: where do you set the sourcetypes of syslog and linux_secure? inputs.conf? If it's in props.conf, you need to look at the priority and ordering of stanzas in props.conf ... View more