Hello I have one big index with lots of files which I want to reroute logs from there to different indexes The reroute will be by regex who is looking for the domain name in the logs For each domain i will create separate stanza in transforms.conf  for example : [setIdx-index1] REGEX = ^(?!.*{ "workflow_id": .*, "workflow_type": .*, "workflow_name": .*, "jira_ticket": .*, "actor": .*, "deployment_status": .*, "start_time": .*, "end_time": .*, ("app_name"|"additional_data"): .* }).*$ FORMAT = new_index DEST_KEY = _MetaData:Index LOOKAHEAD = 40000 my question is about props.conf how should i configure it if i have more than 1 index ? [index1] TRANSFORMS-setIdx = setIdx-index1 TRANSFORMS-setIdx2 = newIndex TRANSFORMS-setIdx3 = newIndex1 TRANSFORMS-setIdx4 = newIndex2 should it work ? ... View more

Hello I'm using Splunk cloud and i want to delete multiple alerts from list. i was trying to do it with curl but got errors that i cannot figure out. is there any other way ? ... View more

Hello, Im using splunk cloud and i have a lot of saved searches - alerts, dashboards, reports that i need to move from one app to another I have lists that map each saved search to the relevant app Is there  a way to do it with api or any other way that it is not manually one by one ?   Thanks ... View more

Hello I'm using Splunk cloud, i have jenkins logs indexed to my system but for some reason breaks I took an output example and add it to Splunk with the "Add Data" option and there it looks ok but when im searching for the sourcetype it is still broken. What is the best way to parse jenkins logs ? this is my sourcetype configuration :   [ console_logs ] CHARSET=UTF-8 LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true SHOULD_LINEMERGE=true category=Structured disabled=false pulldown_type=true   and i want it to be shown with the bulks :   <time> Started by user <time> Finished:     ... View more