Hi, looks nice, thanks. ... View more

Not true - it is configurable.  Be aware tho changing the sourcetype using collect will be metered on ingestion licenses. ... View more

please accept answer if it was helpful 🙂 ... View more

Adding a HF will move the pipelines' processors to the HF, but the order remains the same. You'd have to cook the data twice, which is usually more trouble than it's worth. https://answers.splunk.com/answers/224312/hf1-hf2-indexer-how-to-route-a-set-of-data-that-ha.html Setting TZ per host is much easier than trying to modify the timestamp string per host using regex. ... View more

That sounds bad and is worth a support ticket. ... View more

What else is configured from the sourcetype you're assigning it? Did you restart Splunkd after modifying the sourcetype? line breaking is one of those things that needs a restart Something else to check, do you have a distributed deployment? Where did you apply the props.conf changes? Line breaking should be performed on the system that you are running DB connect on (expecting DB Connect is on a search head) assuming you are sending 'cooked' data to the indexer, which is the default for tcpout (in outputs.conf). If it is not sending cooked data, then linebreaking will need to be done at the indexer. ... View more

The setting on on the role definition manager screen. ... View more

I would suggest using a different approach; SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d+\.\d+\[\d+\]\s+\+\+\+\S\s Which should cut on the newline before a row with '+++' in it Hope this helps, K ... View more

Are you looking for voluntary scrubbing of sensitive information at the splunk user's discretion or are you trying to hide sensitive data from a set of splunk users? ... View more

your props.conf REPORT-attribute = xmlkv_attribute your transforms.conf [xmlkv_attribute] REGEX = (?i)>([^<]+)<\/\S+:([^>]+)> FORMAT = $2::$1 MV_ADD = 1 CLEAN_KEYS = 1 this will set your fieldname and value as below >YOUR_Value</ ns7:YOUR_Fieldname> hope this would help you, happy splunking, eashwar raghunathan ... View more

I think these links should help you: http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Indexmulti-lineevents http://splunk-base.splunk.com/apps/72283/splunk-for-oracle-weblogic-server I would suggest: TIME_FORMAT = ^[%Y-%m-%d %H:%M:%S,%3N^] BREAK_ONLY_BEFORE_DATE = true SHOULD_LINEMERGE = true MAX_TIMESTAMP_LOOKAHEAD = 30 I removed the time_prefix because it would skip the regular expression before starting to try and match a date. So to me, your time_prefix doesn't seem correct with your time_format. That BREAK_LINE_BEFORE doesn't seem to be a valid keyword, it should be BREAK_ONLY_BEFORE. ... View more