How to add the LINE_BREAKER in propd .conf for the below events to get it split to different events . Currently these are comign as combines together    Path =567 xcss sdsf   Path = 5673 dvgsdbdv  v Path = 43343 dvddv    I tried LINE_BREAKER = ([\r\n]+)\Path       SHOULD_LINEMERGE = FALSE But didnt worked  ... View more

Can someone tell me how to use the line breaker parameter fo the below events which is currently getting clustered together . {"sdsf shcdzvdvv zdcnvdzvvdd."} {bfdf  dvdfd  dfdfdf ddgvdvdfd."} {dfdfd dfdfd dgdgd dgdgdgdgg."}   Props .conf LINE_BREAKER = (\.\"\}) ... View more

I have a SED command in props.conf as below  SEDCMD-replace-name = s/ethan/thomas/g   This will replace all ethan with thomas for sure and worked . But the question is if i want to keep the first one as not replaced and replace all second one till end , what should write the command .  I tried the below , 1) SEDCMD-replace-name = s/ethan/thomas/2g     Result - No replace is happening on anything  2) SEDCMD-replace-name = s/ethan/thomas/2   Result - replace is happening only on 2nd 'ethan' as 'thomas' .    Is there a way i can specify the range of numbers here such as 2 to 10 , or 2 to end like that ? please help.  ... View more

My sample events are like this  event 1 My name is Ethan [host="asw.pbrfinance.sdo.dgr.com"] My address is 46e 91 st [host="asw.pbrfinance.sdo.dgr.com"] my city is Atlanta [host="asw.pbrfinance.sdo.dgr.com"] event 2 My name is Thomas [host="asw..sdo.dgr.cowq234wdwaf.mhh.com"] My address is 996e 97 st [host="asw..sdo.dgr.cowq234wdwaf.mhh.com"] my city is Atlanta [host="asw..sdo.dgr.cowq234wdwaf.mhh.com"]   I want to limit the host name coming in the output as only one entry and not multiple times . Is there anyway to do this in props .conf ? Please help me with a proper regex for this .  Expected output  event 1 My name is Ethan [host="asw.pbrfinance.sdo.dgr.com"] My address is 46e 91 st  my city is Atlanta ... View more

Can someone help me with th regex to put in props.conf file to mask the data as below . Except the first three letter , remaing to be masked .  Org_name="ethanfurniturelimited" Org_name="david" required output  Org_name="ethxxxxxxxxxxxxxxxxxx" Org_name="davxxx"     ... View more

I have  a field called org_name in the data as below  Org_name="davidcareerhome" Org_name ="Ethanfurniture" I want to limit the Org_name only for the first three bytes as below  Org_name="dav" Org_name="Eth" Can someone help me with this and how to do make this change in props.conf and the regex for the same ? ... View more

I have copied ITSI app from one  Splunk server to another server . But later when i am trying to access the service analyser, getting the error " Could not load service analyse . Check that you have proper roles and permissions . Detals : An internal error occured." . I dont have this error in my old server where i copued the ITSI configurations . But I verified that all configurations were copied . Can someone help me on this ?  ... View more

I am looking to move the platypus app from one server to another and was able to do that successfully. But i cannot finf where to find the saved dashboards in platypus app which i can copy to the new server . Can anyone help me to find the location of the dashboards where it is  ... View more

I am getting the below error while applying the shcluster changes to sh custers      ... View more

The requirement is, there is a single index . Data in three different format and there is an InputType coming in the raw data to identify . Below is just an exmaple  InputType="mBP" |name|employee id|username|address|designation | manager name InputType="eMQ" |designation|years of emp|office location|department  InputType="qCP" |department| department head| employee count | designations  The data format is different in these cases . So the question is , it is posisble to have different parcing based on the InputType ? What is the solution for this ? Do i need to create new 3 indexes ? or wth in same index , how the 3 different parcing can be done ? what are the conf file changes required? Help is appreciated with different  possible solutions on this .  ... View more

I have a requirement to add new data format to splunk . Below is the sample data . If i want to setup a new sourcetype based on the field 'InputType', what are the changes required in the props.conf file and transforms.conf file ? I want the sourcetype to display the values aMG, zRP or bKL Sample data InputType="aMG"|filename <K............ InputType="zRP"{dataformat..>........... InputType="bKL"$%mo << ........ InputType="aMG"\dataformat.......           ... View more

My logfile is like below, "timestamp": "2021-03-22 22:37:35".  Can someone tell me how to edit the props file correctly ? My current props file doesent have the time parameters listed . DATETIME_CONFIG = KV_MODE =json # INDEXED EXTRACTIONS =json NO_BINAY_CHECK= true Appreciate the help on this  . Shoud I give TIME_PREFIX= timestamp ? What else parameters required ? ... View more

I have diffeence between _time and timestamp in terms of second . ( 5  to 50) . How to make the _time to get the exact value as timestamp ? any quick query will do other than modifying the propd conf file ? What values in props.conf file should be changed to make this success ? ... View more

Is there individual indexer specific conf files present specially for Props.conf file ?  In Linux , how can we identify the indexer specific conf files for a particular index ? ... View more

While doing the schedule and export option of PDF generation , the graph format is getting truncated . However , the print then save as PDF option is working correctly. Is this because of the issue with the Limits.conf file ? I was mentioning about the default value of Max_rows_per_table as 1000.  Please suggest a best way to fix this issue or is this expected on PDF generation and no solutions available .  ... View more

I could see there is a slight difference ( in seconds - from 1 to 10) between the _time and the timestamp field in the row data. Is this expected or this should be exacty matching ? Please note that the difference is only interms of seconds .  Is there someway to fix this issue ? What could be the reason the _time is not showing exact time as in the timestamp ?    ... View more