Hi, I searched a lot and found no answer. I have data with the above timestamp and I want to convert it into local time. extract="year, month, day, hour, minute, second, zone" with  (\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\S+)\s+ works OK when time zone is given in the form of "+0000", yet not with "UTC". Is there something like "litzone" available? Thanks in advance Volkmar ... View more

Hello, I have a three member SHC (splunk 8.0.5.1) and want to replace the members one by one with new instances running on the same IP addresses, so first adding the new and then removing the old ones is not an option. In my plan A, I set the SHC to static captain and then tried to remove a member on the captain's command line: $ splunk remove shcluster-member -mgmt_uri https://1.2.3.4:8090 Raft is not initialized. This means that dynamic captain mode was not set in server.conf. How can I remove the member without going into dynamic mode? This has been asked before, but I saw no useful answer. Is it possible at all? And if so how? (If not: why?) Plan B would be juggling with ports etc but that may get a bit messy. Thanks in advance Volkmar ... View more

Hi, we are seeing > 70,000 of these messages per day per instance on several Searchheads on Splunk 8.0.5.1 and SUSE Linux 12: WARN SearchResultsCSVSerializer - CSV file  contains invalid field '', ignoring column. (there are actually two spaces after "file", and '' are two single quotes) In a Searchhead Cluster only the captain seems to report this. If I clone the Splunk installation from an affected Searchhead to another, similar but unaffected one that doesn't show the symptoms, I cannot reproduce the messages there. At startup it kicks in around here: 04-12-2021 16:56:47.361 +0200 INFO ServerRoles - Declared role=search_head. 04-12-2021 16:56:49.680 +0200 INFO ServerRoles - Declared role=kv_store. 04-12-2021 16:56:49.684 +0200 INFO CertStorageProvider - Updating status from starting to ready 04-12-2021 16:56:49.684 +0200 INFO CertStorageProvider - Updating status from starting to ready 04-12-2021 16:56:49.684 +0200 INFO Rsa2FA - Could not find [externalTwoFactorAuthSettings] in authentication stanza. 04-12-2021 16:56:50.911 +0200 WARN SearchResultsCSVSerializer - CSV file  contains invalid field '', ignoring column. When the system goes down it stops here: 04-12-2021 16:56:02.889 +0200 WARN SearchResultsCSVSerializer - CSV file  contains invalid field '', ignoring column. 04-12-2021 16:56:03.831 +0200 INFO loader - Shutdown HTTPDispatchThread 04-12-2021 16:56:03.831 +0200 INFO ShutdownHandler - Shutting down splunkd a) Has anyone seen this too? And if so, fixed it? How? b) How can I get Splunk to report some more detail, like who wants to open that file? I found no useful information on the SearchResultsCSVSerializer and "strace" on Linux did not provide any clue for me either. Thanks in advance Volkmar ... View more