sorry, i forgot to update. after you proposed username=="$tUser$" i tried username="$tUser$" and that did the trick 😉 thank you... ... View more

i'm not really sure what you mean. i copied now two events resulting this search index=tvlog "support sul" it shows 324 events containing user "Support SuL" and "Support SuL 2" index=tvlog username="support sul" shows 161 results with only user "Support SuL" index=tvlog username="support sul 2" shows 163 results  with only user "Support SuL 2" 2022-08-08 11:25:57,2022-08-08 11:33:52,"0:07:55",cabb2212-93b4-42e9-b890-2be47b841d82,u173443428,"Support SuL",230088210,PC1102,g170315939,PC1102 date_hour = 11date_mday = 8date_minute = 25date_month = augustdate_second = 57date_wday = mondaydate_year = 2022date_zone = localeventtype = nix-all-logshost = srv141index = tvloglinecount = 1source = /opt/splunkforwarder/etc/apps/PBNL_getTVlog/log/TVlog.csvsourcetype = csvsplunk_server = srv091splunk_server_group = dmc_group_indexer splunk_server_group = dmc_indexerclustergroup_SplunkClusterPBNLtimeendpos = 27timestartpos = 0 2022-08-05 06:58:45,2022-08-05 14:00:26,"7:01:41",d3e88821-f7b7-45bd-a18d-91d2dc147458,u174066842,"Support SuL 2",265385451,PC1153,g162593205,PC1153 date_hour = 6date_mday = 5date_minute = 58date_month = augustdate_second = 45date_wday = fridaydate_year = 2022date_zone = localeventtype = nix-all-logshost = srv141index = tvloglinecount = 1source = /opt/splunkforwarder/etc/apps/PBNL_getTVlog/log/TVlog.csvsourcetype = csvsplunk_server = srv091splunk_server_group = dmc_group_indexer splunk_server_group = dmc_indexerclustergroup_SplunkClusterPBNLtimeendpos = 27timestartpos = 0  these searches are all correct, but in the dashboard i need to deal with the token $tUser$. ... View more

tried that too without success ... View more

thank's for the answer, but none of your proposals returns a result 😞 ... View more

so nobody else any idea why? to bring in some more details: the splunk landscape is build out of 4 servers. 1st is Cluster Master, KV Store, License Master, Search Head 2nd and 3rd are Indexer 4th is Deployment Server the index tvlogs is defined on the cluster master with a whole bunch of other indexes etc/master-apps/_cluster/local/indexes.conf [tvlogs] repFactor = auto maxHotSpanSecs = 86400 homePath = $SPLUNK_DB/tvlogs/db frozenTimePeriodInSecs = 15552000 thawedPath = $SPLUNK_DB/tvlogs/thaweddb coldPath = $SPLUNK_DB/tvlogs/colddb and it's deployed to the indexer cluster splunk@indexer1:[/opt/splunk]: ll var/lib/splunk/tvlogs/* var/lib/splunk/tvlogs/colddb: total 8 drwx------ 2 splunk splunk 4096 Jul 22 14:20 ./ drwx------ 6 splunk splunk 4096 Jul 22 14:20 ../ var/lib/splunk/tvlogs/datamodel_summary: total 8 drwx------ 2 splunk splunk 4096 Jul 22 14:20 ./ drwx------ 6 splunk splunk 4096 Jul 22 14:20 ../ var/lib/splunk/tvlogs/db: total 16 drwx------ 2 splunk splunk 4096 Aug 10 09:17 ./ drwx------ 6 splunk splunk 4096 Jul 22 14:20 ../ -rw------- 1 splunk splunk 169 Aug 10 09:17 .bucketManifest -rw------- 1 splunk splunk 10 Jul 22 14:22 CreationTime the other files are located on the UF where the script should run splunk@srv141:~/etc/apps/PBNL_getTVlogs$ ll * bin: total 20 drwxr-xr-x 2 splunk splunk 4096 Aug 11 14:50 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ -rwxrw-r-- 1 splunk splunk 573 Aug 11 14:50 getTVlogs.sh* -rwxrw-r-- 1 splunk splunk 687 Aug 11 13:34 json2csv* default: total 16 drwxr-xr-x 3 splunk splunk 4096 Aug 11 13:34 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ -rw-r--r-- 1 splunk splunk 181 Aug 11 13:34 app.conf drwxr-xr-x 3 splunk splunk 4096 Aug 11 13:34 data/ local: total 20 drwxr-xr-x 2 splunk splunk 4096 Aug 11 13:34 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ -rw-r--r-- 1 splunk splunk 55 Aug 11 13:34 app.conf -rw-rw-r-- 1 splunk splunk 258 Aug 11 13:34 inputs.conf -rw-rw-r-- 1 splunk splunk 388 Aug 11 13:34 props.conf logs: total 16 drwxr-xr-x 2 splunk splunk 4096 Aug 11 14:49 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ metadata: total 16 drwxr-xr-x 2 splunk splunk 4096 Aug 11 13:34 ./ drwxr-xr-x 7 splunk splunk 4096 Aug 11 13:34 ../ -rw-r--r-- 1 splunk splunk 403 Aug 11 13:34 default.meta -rw-r--r-- 1 splunk splunk 187 Aug 11 13:34 local.meta do i need to change something here? ... View more

no. the only thing i see in the UF's log is, that the app is installed. all files and folders are created. the monitor is created too: splunk@srv141:~$ splunk list monitor Monitored Directories: $SPLUNK_HOME/var/log/splunk some other directories Monitored Files: $SPLUNK_HOME/etc/apps/PBNL_getTVlogs/logs/TVlogs.csv some other files ... View more

hi, this was my fear after i read the comment of richgalloway. that's completely stupid, but it's like it is. i'm fiddling already around with reindexing the files to a new index, but for some reason splunk will not do so 😉 there seems to be no way to make splunk forget about an already indexed file and reindex the same file to a new index. besides changing the first line of the file. this is not what i want to do. maybe i'm going this way thanks for bringing light in the dark 😉 ... View more

nobody any idea here?  ... View more

the restriction i added when creating the role is: sourcetype::log4jscan when i click on 'Preview search filter results' i get: index=main | search sourcetype::log4jscan this give me the results i want. but running a search from an other role e.g. index=msexchange OR index=srv066-vm OR index=srv067-vm OR index=ve2k8clu doesn't return any results ... View more

thank you ... View more

hello, i'm actually on the same task and have an issue too. maybe we could help each other. my issue is, my batch file cannot delete %SPLUNK_HOME%\etc\system\local\deploymentclient.conf. splunkd.log on the client says: 04-08-2022 11:15:59.383 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\PBNL_DSconfig\bin\deleteDSconfig.bat"" The system cannot find the path specified. do you use %SPLUNK_HOME% in your delete script or the full path? and a question to your app: you have a new deploymentclient.conf in your app? i know, sounds stupid, but you never know 😉 p.s. on my linux clients the script worked. of course with / instead of \ and the name of the sript is .sh not .bat ... View more

ok. i will do. and indeed, you can help me with another issue. but in a new thread 😉 ... View more