Hi splunkers.    I would like to understand a tricky point.   I'm using a distributed environment with 2 intermediate universal forwarders. They have to deal with 1.2 TB of data per day. 1 - Strangely, these UF have their parsing queues used (TOP 1 of the queues usage !) and these forwarders are UF !!!   2 - These UF have 4 pipeline. If one of these pipeline parsing queue is full, the entire UF refuse connection from upstream forwarders.   There queues size where increased to 1GB (input / parsing / output ...). But sometimes, this situation comes back.   Have you got any idea what could hapening ? ... View more

Hi splunkers ! I m facing an issue that is going to make me crazy ! I've got to set the timestamp in the following logs (timestamp field is the 11th field, the first one being the insert time by the proxy himself)  : 2024-09-16T13:12:54+02:00 Logging-Client  "-1","username","1.2.3.4","POST","872","2211","www.facebook.com","/csp/reporting/","OBSERVED","","1726484997","2024-09-16 11:09:57","https","Social Networking","application/x-empty","","Minimal Risk","Remove 'X-Forwarded-For' Header","200","10.97.5.240","","","Firefox","102.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0","firefox.exe","1.2.3.4","443","US","","t","t","t","f","f","computerName","","1.2.3.4","1.2.3.4","8080" So, I'm using a regex to extract fields and set the real timestamp in my props.conf :  [mySourcetype] SHOULD_LINEMERGE = false EXTRACT-mySourcetype = ^[^,\n]*,"(?P\w+)","(?P[^"]+)","(?P\w+)","(?P[^"]+)[^,\n]*,"(?P[^"]+)[^,\n]*,"(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P(?=\s*)|[^"]+)","(?P[^"]+)","(?P[^"]+)","(?P[^"]+)"$ TIME_PREFIX = (?:[^,]+,){11} TIME_FORMAT = %Y-%m-%d %H:%M:%S     Then, Ive got different results based on different source: Upload a file directly in the search head                      Extraction    Ok         Timestamp    OK File red from an universal forwarder                       Extraction     OK           Timestamp  Failed   The is NO heavy forwarder between the UF and the indexers. The props.conf is deployed only on the SearchHeads. So, Something is tricky here !   If someone got an idea, I will apreciate ! Cheers. ... View more

Hi,   I wana keep only logs Not containing the word "chatbot". This word is present in the _raw data I'm using the method explained in the following doc : Routeandfilterdatad  The props.conf and transforms.conf are set on the indexers and I restarts my indexers   But logs with this word are still present. Any idea, or way to debug this point ?   props.conf     [MySourcetype] INDEXED_EXTRACTIONS = JSON TIME_PREFIX=\"timestamp\": TIME_FORMAT=%s%3N #Do not index chatbot data TRANSFORMS-null = API-NullQueue       transforms.conf     [API-NullQueue] REGEX = chatbot DEST_KEY = queue FORMAT = nullQueue       Thank's all. ... View more