Hi Folks, We have a use case where we need to send OS logs from Chef /Puppet instead of UF to Splunk Indexer. Can we do that? Has anyone done it before? Please confirm ASAP.         ... View more

Hi Folks, We would like to mask mainframe logs. We can use props and transforms, apart from this do we have any other alternative.     ... View more

Hi Team, We have created a dashboard and passing the device number from the form input token to the dashboard panel, it works properly when passing the device number but when we pass (*) wildcard character, we get an error message " Error in 'rename' command: Wildcard mismatch", when we use the rename command like this "rename abc* as mcd* it show the number of columns for all the device number. However, we want to show only 5 columns For example : We get correct data when we pass the device number but when we pass * wildcard character it increases the device numbers columns   Time Device_Number Router_Model Router_Name 10.30 abc123 ABC1234 Cisco123 11.30 abc123 DEF1234 Cisco1234 12.30 abc123 EFG1234 Cisco567  1.30 abc123 CDE1234 Cisco789    When passing wildcard character in the query: Time abc123_Device_Number def123_Device_Number ghi123_Device_Number abc123_Router_Model def123_Router_Model ghi123_Router_Model abc123_Router_Name def123_Router_Name ghi_Router_Name 10.30 abc123 def123 ghi123 ABC1234 NCFMM_Cisco AGBDVDMM_Cisco Cisco Netgear Netgear 11.30 abc123 def123 ghi123 CDE3434 NCFMM_Cisco AGACJJBCJM_Cisco Netgear Netgear Netgear 12.30 abc123 def123 ghi123 GHI1233 NCFNNM_Cisco AGAGDNM_Cisco Cisco Netgear Netgear 1.30 abc123 def123 ghi123 LEF1232 NCDDMM_Cisco AGABDBDMM_Cisco Cisco Cisco Cisco 2.30 abc123 def123 ghi123 HDDF112 NCDDM_Cisco AGAGBBM_Cisco Netgear Netgear Netgear   when passing wildcard character from the token then using in the rename increases the columns, when normally passing token without wildcard it is proper, can we wildcard in such a way that columns count don't increase.    Thanks in advance for the help!   ... View more

Hi Folks, Is there a way we can have same timezone for all the alerts, reports, dashboards that we created in Splunk? For instance: We have an admin user created in GMT zone, all the reports, alerts and dashboards have been created using this user in GMT timezone. When any other user runs or modifies the reports, alerts or dashboards, it gets changed to their timezone preference. Can't we keep a fixed timezone for all the reports and alerts?   Regards, Manish   ... View more