Hi @AK_Splunk, let me understand: where do you whould take the hostname value to associate to an event, from a path segment or from the UF hostname, or a part of the log itself, or where else? Anyway, using the "host" option in inputs.conf, you can assign one fixed value to the host field. You can also extract the host field from the path of the file or from a part of the name. outside inputs.conf (using props.conf and transforms.conf on Heavy Forwarders or Indexers), you can also extract the host from the content of the event overriding the default value. Ciao. Giuseppe ... View more

Hi @AK_Splunk, an additional information: you can extract the host from the path using the segment or a regex still on path or filename: host_regex = <regular expression> * If specified, <regular expression> extracts host from the path to the file for each input file. * Detail: This feature examines the source key; if source is set explicitly in the stanza, that string is matched, not the original filename. * Specifically, the first group of the regular expression (regex) is used as the host. * If the regex fails to match, the input uses the default 'host' setting. * If 'host_regex' and 'host_segment' are both set, the input ignores 'host_regex'. * No default. host_segment = <integer> * If set to N, the Splunk platform sets the Nth "/"-separated segment of the path as 'host'. * For example, if you set "host_segment = 3" and the path is /logs/servers/host08/abc.txt, the third segment, "host08", is used. * If the value is not an integer or is less than 1, the default 'host' setting is used. * On Windows machines, the drive letter and colon before the backslash *does not* count as one segment. * For example, if you set "host_segment = 3" and the monitor path is D:\logs\servers\host01, Splunk software sets the host as "host01" because that is the third segment. * No default. as described at https://docs.splunk.com/Documentation/Splunk/9.0.4/admin/Inputsconf Ciao. Giuseppe ... View more

permission for working server -rw------- 1 root utmp 1031424 Mar 22 17:06 btmp -rw------- 1 root root 282038 Mar 22 17:35 cron -rw------- 1 root root 4591461 Mar 22 17:37 messages -rw------- 1 root root 725824 Mar 22 17:37 tallylog -rw-rw-r-- 1 root utmp 1989120 Mar 22 17:37 wtmp -rw-r--r-- 1 root root 3311572 Mar 22 17:37 lastlog -rw------- 1 root root 624826 Mar 22 17:38 secure there is no specific splunkd.log error ... View more

Thanks for your response. The data I showed is event data which is the time stamp of 2024 and the time should be showing as today's date and time. ... View more

Hi @AK_Splunk, to send code or sample data use the "Insert/Edit code sample" ("</>") button. Ciao. Giuseppe ... View more

Hi @AK_Splunk, please try this regex : | rex "\]\s+(?<Devicename>[^;]+)" that you can test at https://regex101.com/r/GDOK8U/1 Ciao. Giuseppe ... View more

You said that before.  Please elaborate.  When you say the regex is not working fine in a clustered environment, what exactly does that mean?  How do you know it's not working right?  Does the problem exist on all cluster members or just some of them?  Is the props.conf file distributed to all cluster members? ... View more

Thanks a lot! It worked. ... View more

Hi @AK_Splunk  can you run  query1 or query2 search in search head , hope one of helps your requriment  Query1 index=_internal source="*metrics.log" group="tcpin_connections" | dedup hostname | rename host as "receiver host" hostname as "sender host" | table _time "sender host" connectionType version sourceIp destPort ssl fwdType "receiver host"  Query2 index=_internal source="*metrics.log" host IN (UF1,UF2)  group=tcpout_connections | stats count by host destIp destPort ... View more

Hi @AK_Splunk, if you have intermediate Heavy Forwarders, you have to install the TA also there, but your issue shouldn't be related to this because fields are extracted at serahc time, so only the TA installed on Search Head is relevant. Anyway, I continue to not understand what you mean with "all interesting fields we should be getting for default inputs file monitoring?": enabling the above six inputs, Forwarders reads the files in the related folders and send them to Splunk where they are parsed and indexed so you have available all the relevant fields. Ciao. Giuseppe ... View more

You need to demonstrate your data, in text form. (Anonymize as needed, but maintain format.)  How does a _raw event look like? ... View more

Hi @AK_Splunk, sorry, I don't know how I did to not see it! Anyway, please try this: | rex "Alias\s+(?<Alias>\w+)" Ciao. Giuseppe ... View more

Hi @richgalloway    Thanks for your response. When I run the command ./splunk list monitor in my uf I am able to see the input i.e. I get the expected file path.   few steps that I tried from my end. I appended the files at same location for AMER,APAC and Emea-non-ngdc, I can see the appended changes reflecting in the splunk sh but still not getting data from Emea-non-ngdc.      ... View more