Hi @PickleRick  You are quite right - this will teach me for trying to do too many things at once as was also doing some INGEST_EVAL work at the same time. 🙄 I've removed the completely incorrect start to the paragraph about DMs and will update the sentence around "can be accelerated" to include details about what this achieves. Thanks again for catching those points! ... View more

below also give same results, please let me know if its right too.. "(?<severity>Severity:\w+;)" ... View more

below can extract:  "(?<time>Time:\d+\-\d+\@\d+:\d+:\d+\.\d{1,3})" ... View more

Hi @okumar1 , this means that there's something in the middle between UD and IDX that block the connection. probably an intermediate firewall or a local firewall on the IDX. Ciao. Giuseppe ... View more

There is no automatic script, but you can write one.  Don't have it issue the set deploy-server command, however.  Have it delete $SPLUNK_HOME/etc/system/local/deploymentclient.conf.  Put this in an app called "fix_deployclient", but don't deploy it, yet. Create a new app called "all_deployment_client" and add to it the existing $SPLUNK_HOME/etc/system/local/deploymentclient.conf file from one of your forwarders.  Set the app to restart splunkd when it deploys. Now deploy all apps to all forwarders.  This will move the deployment server config to a custom app.  The next time you need to make a config change to your forwarders, modify the all_deployment_client app and re-deploy it. Never use the set deploy-server command again.  Why?  Because that command puts entries in $SPLUNK_HOME/etc/system/loca/deploymentclient.conf, which overrides all other deploymentclient.conf files, making it impossible to make a change from the DS. Another option is to use your company's management software (Ansible, Puppet, etc.) to change all of the forwarders. ... View more

no all 4 indexers are standalone only and i have added all these 4 search peers into SH under distributed search. Please guide me ... View more

Hi @okumar1  It seems you have confiured inputs.conf  with internal index name , ideally _internal need to contains only Splunk logs which are related to Splunk application. can you check your inputs.conf on UF/where zoom logs are generating  ideally it should present under $SPLUNK_HOME/etc/system/local if you are not sure about the inputs.conf location run follwing command from $SPLUNK_HOME/bin ./splunk btool inputs list <mention sourcetypeof zoom> --debug inptus.conf  chck the index the name mentioned for zoom_input.log  and update the correct index name other than _internal and restart the splunkd  exmaple inputs.conf  [monitor:///zoom_input.log] sourcetype = access_common Index=<update for correct index name> ... View more