Route logs from combined_large.log to webapp1_index or webapp2_index based on log content ([webapp1] or [webapp2]). Setup: Universal Forwarder: Windows (sending logs) Indexer: Windows (receiving & parsing) Logs contain [webapp1] or [webapp2] Expect routing to happen on the Indexer Sample log: 2025-05-03 16:41:36 [webapp1] Session timeout for user 2025-04-13 20:25:59 [webapp2] User registered successfully inputs.conf (on UF): [monitor://C:\logs\combined_large.log] disabled = false sourcetype = custom_combined_log index = default props.conf (on Indexer): [custom_combined_log] TRANSFORMS-route_app_logs = route-webapp1_index, route-webapp2_index transforms.conf (on Indexer): [route-webapp1_index] REGEX = \[webapp1\] DEST_KEY = _MetaData:Index FORMAT = webapp1_index [route-webapp2_index] REGEX = \[webapp2\] DEST_KEY = _MetaData:Index FORMAT = webapp2_index Tried: Verified file is being read Confirmed btool loads configs Restarted services Re-indexed by duplicating the file Issue: Logs not appearing in either webapp1_index or webapp2_index Questions: Is this config correct? Am I missing a key step or wrong config location? Any way to debug routing issues? Any help or insight would be greatly appreciated. Thanks in advance 🙏     ... View more

Dear All, Unable to send data from universal forwarder, to Splunk Enterprise i have minimal knowledge in Splunk  I'm trying to configure universal forwarder but unable to success could you please help me in this regards Please find the below my configurations i am using Splunk Enterprise 9.0 and universal forwarder version 9.1.1using Cent OS 7.0 inputs.conf [root@Universalforwarders local]# [monitor:///var/log/messages] index=os disabled=0 outputs.conf [root@Universalforwarders local]# [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] [server://192.168.122.1:9997]   i used following command to check port status: netstat -an | grep 9997 tcp     0     0   0.0.0.0:9997   0.0.0.0:*   LISTEN localhost.localdomain --- my Splunk enterprise instance 127.0.0.1 --- my Splunk Universal forwarder   i want to know where i am doing mistake would be appreciate your kind support thanks in advance             ... View more

Hi splunkers, I would like to inform you that i am using below geostat spl, but i am unable to get result can anyone help me please where i am doing mistake i have chosen .csv file source type when i am trying to get spl result it says no data found index="main" | geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry Would be appreciate your kind support. thanks in advance ... View more

Dear Splunkers, I would like to inform you that, I am very curious to learn splunk admin, can anyone refer me good YouTube channel or any other online institute moreover If possible please provide me list of topics available in splunk admin course Would be appropriate your kind support Thanks in advance.. ... View more