Hi ,  I have a transforms to send logs from prod hosts to one index and from non prod to other.  Transforms: [prod] DEST_KEY = MetaData:Index REGEX = (.*-prd.*) FORMAT = index_a [nonprod] DEST_KEY = MetaData:Index REGEX = (.*-nprd.*) FORMAT = index_b   Above transforms is working fine for all logs from those hosts. But now the problem is I only want it to be applicable to //var/log/messages and //var/log/secure.   any suggestions if I can multiple regex conditions based on host I.e. prd and source path ?   appreciate your help on this 🙂 ... View more

Hi All, I have just copied across working props and transforms stanza from one HF to another for sqs logs.  however it’s having issues on using this props and transforms since logs are stopping and I am getting a message “start writing events to STDOUT” host=“ “ index=“<index>main</index>” stanza= “ “   I am using that transforms to extract hostname index name , source and sourcetype.  any help appreciated! Thanks  ... View more

I am having an issue with one of my monitor stanza in inputs.conf. The stanza is as below:  [monitor://E:Speech\Tomcat2232\logs\abc-call-router.log] index = x sourcetype = y blacklist = .(gz|tar|tgz|zip|bkz|arch|etc|tmp|swp|nfs|swn)$ disabled = 0 So I am expecting the above monitor to only ingest E:\Speech\Tomcat2232\logs\abc-call-router.log but it is also igesting E:\Speech\Tomcat2232\logs\abc-call-router.log.1 and E:\Speech\Tomcat2232\logs\abc-call-router.log.2 which I don't want to happen. Does anyone knows why it is happening.? I have been scratching my head. Any help appreciated. Thanks. ... View more

I want to monitor our Linux Splunk instances and am using the Splunk Add-on for Nix to collect metrics data and am sending it to em_metrics index and monitoring them as SAI entities via SAI on search head.  We have a clustered environment. I am trying to get data from 3 members indexer cluster and 3 members SH cluster. We have universal forwarders installed on all of our instances. I tried to deploy the add-on to UF’s but I couldn’t see the entities on SAI (no data coming through from the hosts).  Now I have installed Nix add-on to the indexer cluster and SH cluster and have changed the inputs to send data to em_metrics index being used in SAI.  The issue that I am facing is for the indexer/SH cluster it is only displaying indexer master and SH cluster captain entities in SAI. I can see the IP's of other members in the dimensions of entities, but I want each host as a seperate entity.  Could anyone please guide me through if I am doing something wrong or how I can achieve what I want to see SAI app? I have been stuck for a few days, so any help is appreciated.  Thanks. ... View more

I am trying to configure Splunk_TA_nix to collect nix data from our Hf but the inputs aren’t  being enabled. We have clustered env.  I have followed the splunk doc to install and configure the Addon but on attempting to enable the metrics via UI em_metrics index is already selected and greyed out but it says search produced no results.   checked splunkd logs and could not find any error related to this.  any help appreciated, thanks  ... View more

Hi, I am expecting an event at 7:15 and I want write a search that should give me results as below:   If event arrived at 7:15 — result -1  If event not arrived at 7:15  result - 2 if event doesn’t arrive 30mins after 7:15 - result 3  the moment I received the event result-1   thank you for your help in advance. ... View more