I tried the props settings you suggested but still same issue.   ######   BEGIN STATUS   ##### is coming as a separate event. #LAST UPDATE : Wed, 29 Nov 2023 10:39:57 +0000 GlobalStatus.status=OK  , this is also coming as a separate event  Both these events should come under one event.   ... View more

My script name was access-abc.sh ,  I just removed hyphen and renamed it to accessabc.sh and that fixed the issue and able to see the Data in Splunk. But now I have issue with event Formatting, Actual website data I am ingesting is shown below: ##### BEGIN STATUS ##### #LAST UPDATE  :  Tue,  28  Nov  2023  11:00:16  +0000 Abcstatus.status=ok Abcstatus.lastupdate=17xxxxxxxx555     ###  ServiceStatus  ### xxxxx xxxxxx xxxx ###  SystemStatus  ### XXXX' XXXX   ###  xyxStatus  ### XXX XXX XXX . . . . So on....   But in splunk below lines are coming as a seperate events instead of being part of one complete event: ##### FIRST STATUS #####  - is coming as seperate event Abcstatus.status=ok  - this is also coming as a separate event   Below all events coming as one event which is correct and the above two lines should also be part of this one event: Abcstatus.lastupdate=17xxxxxxxx555 ###  ServiceStatus  ### xxxxx xxxxxx xxxx ###  SystemStatus  ### . . . So on.... #####   END STATUS  #####   Below is my props: DATETIME_CONFIG = CURRENT SHOULD_LINEMERGE=TRUE BREAK_ONLY_AFTER = ^#{5}\s{6}END\sSTATUS\s{6}\#{5} MUST_NOT_BREAK_AFTER=\#{5}\s{5}BEGIN\sSTATUS\s{5}\#{5} TIME_PREFIX=^#\w+\s\w+\w+\s:\s MAX_TIMESTAMP_LOOKAHEAD=200   Can you please help me with the issue?     ... View more

Hi @richgalloway  I have changed the stanza to script from monitor but still unable to see any data in splunk? Is there anything else I have to check? ... View more

I did not understand the difference between the two stanzas can you please explain  ... View more

How to run the script from database? ... View more

In the first condition how can splunk check months old logs  I didn't understand the second condition can you please explain clearly what does limits have to do with reading old logs? ... View more

In the first condition how can splunk check months old logs  I didn't understand the second condition can you please explain clearly what does limits have to do with reading old logs?     ... View more

Check if that index is associated to any splunk role if yes check if you have access to that role then you can see that index while you search may be  One more to check is there any data sent to that index         ... View more

In the internal logs it gives error " parsing configuration stanza" ... View more

@isoutamo I have tried the configs but still same issue   Please find the props        ... View more

Thanks for the Response @isoutamo  The first number in the timestamp 1/09/2022, 2/09/2022 is day and the second number is month shall I use DATETIME_CONFIG as NONE or CURRENT? and DATETIME_CONFIG=NONE Does exactly what, if you can explain this that would be great! 🙂   ... View more

Is the issue fixed? ... View more

Me too looking for the same ... View more

Yes I need help on creating the add-on if I have to apply the first solution ... View more

Ok then for what purpose the hosts is mentioned in inputs which I saw in some configurations ... View more

About second solution, We actually don't use transforms much, but work on props based on sourcetypes So not sure if this can be achieved just in props     ... View more

Can't we achieve this mentioning the host details in inputs.conf Let's say     [monitor://data/abc/vault.log] index=applog Host=dx096865 By doing this don't I  get just the vault.log from just that host?   ... View more