Hello,  There is this old system where we want to upgrade splunk to the newest version First we want to upgrade the forwarders on 3 test servers  The current version of splunk universal forwarder is 7.0.3.0 We want to rise it to the 9.21 Would that version works for the time being with Splunk Enterprise 7.3.1? I know it would be better first upgrade the enterprise, as best practice is to use indexers with versions that are the same or higher than forwarder versions. (but there is hesitation to upgrade indexers first, as it's used also for data from production) But would it be possible to do forwarders first?  Edit: Upgrade was succesfull 😄  ... View more

Hello, I need to take events with two kind of text (different paths) : Appended to:  G:\Streamserve\ Appended to:  D:\G_volume\Streamserve\ As you can see the is part in the middle that should be different (I have only those 2 kind of cases). I tried with \S* as non whitespace characters but it's not working.   sth like this Appended to: \w?:\\(G_volume)*\\*Streamserve What's is the easiest way to do it?  Thanks fo the help ... View more

Is there a way to reduce memory usage for splunk Forwarder? I have two directories with 57k files each (120Mb each) and After restarting service I checked Task manager and memory usage reach 2Gb. I can't reduce the number of files because I've already done that and can't reduce more. I'm sure that the issue is with those directories because after I delete them from inputs.conf memory reach only 100Mb.  ... View more

I have a folder with logs, every hour one logfile is written to it.  I also have an alert that is triggered when no file is written in the last hour (checking 15 minutes post a hour) Query: index=xyz sourcetype=abc | eval since = now() - _time | search since < 3600 Mostly it works but sometimes it's triggered even if I can see in the history that logfile for that hour is present in splunk with acurate _time and nothing is missing What could be the problem? ... View more