I am doing some lab work and am struggling with a date/time extraction for an XML file. There is *some sucess as I can get the date out of the data (between two <ActionDate> tags) though when I look at the ordering of the data, it is out of sequence. I am doing this on a Stand Alone instance via the front end. I am wondering if something is off in my config, can any one advise?     SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)\s*<Interceptor> BREAK_ONLY_BEFORE_DATE=null NO_BINARY_CHECK=true CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=15 TIME_FORMAT=%F TIME_PREFIX=<ActionDate> kv_mode=xml pulldown_type=true TZ=America/New_York       Here is a screenshot too with how it is showing. Note the dates are not in sequence. What could be causing this?       Thanks   ... View more

Hi All,   I have a blanket index cluster and a cluster manager. I have added some config to push out an indexes.conf file with repFactor = auto. The config applyed and rolled out sucessfully to the peer nodes. However, when i look at the SH on the Cluster Manager under, settings > indexer clustering, I cannot see the indexes as replicated. On a clustered indexer, the config is as follows: /opt/splunk/etc/peer-apps/_cluster/local/indexes.conf         [hoopla] repFactor = auto homePath = $SPLUNK_DB/hoopla/db coldPath = $SPLUNK_DB/hoopla/colddb thawedPath = $SPLUNK_DB/hoopla/thaweddb             I've tried a few variations and am a bit puzzled - Am I doing anything massivley wrong here? Should i see empty indexes here? ... View more