Fairly new to Splunk so may not have the correct terms for everything. Currently working in a distributed environment with Splunk Enterprise with windows and Linux host. These hosts are sending logs via UFs to the clustered indexers. There is also an HF that is receiving logs from apps and AWS. My issue is that the logs coming from my UF are not being parsed into field name-value pairs. The windows/Linux host, indexers, and Search Heads all have the splunk_TA_nix and splunk_TA_windows add-ons installed.  I almost feel like my indexers are not parsing the data that is coming in. Log data is getting into Splunk and I can see my events however it is all in a format similar to this, very crude I know.     <data><data><data>1039<data><data><data>time<data><data>program<data>splunk<data>     I would like it to be in field name values.  At some point I was receiving logs in this format however I am no longer. What could be causing this?      time: 10:39 program: splunk           ... View more

Hey! So I have a a self host splunk enterprise environment with a Cluster Master(deployment server is a separate instance) and 3 indexers. I am trying to push apps to my indexers but when i change the Master-apps folder and add in the applications and then run a 'splunk cluster-apply' i get the following our put.  No new bundle will be pushed. The cluster manager and peers already have this bundle with bundleId=9FE2BF9FC21C0681C01644653BD69C6C.  Before this I did push a single app and it worked fine then I removed it. Now I am trying to push multiple apps and getting the output above ... View more