Missing indexes Any one have a way to investigate what causes indexes to suddenly disappear? Running a btool and indexes list… my primary indexes with all my security logs are just not there. I also have a NFS mount for archival and the logs are missing from there too. Going to the /opt/splunk/var/lib/splunk directory I see the last hot bucket was collected around 9am. I am trying to parse through whatever logs to find out what happened and how to recover. ... View more

I am trying to extract some field values that comes in the following format <date>00-mon-year</date> <DisplayName>example</DisplayName> <Hostname>example</Hostname>   When using the spl rex function i am able to extract the fields using  rex field=_raw "Hostname>(?<hostname>.*)<".   Then i have tried to use both a inline regex function in props with the same regex (without quotes) and it does not work. I have also used a transforms.conf with the stanza as follows [hostname] FORMAT = Hostname::$1 REGEX = Hostname>(?<hostname>(.*?))</Hostname   then in the props REPORT -Hostname = hostname   and this does not work.   However, i have another source that pulls the same type of logs and i am able to use inline regex in spl format just fine with no issues. This issue is only specific to this source which i have as [source::/opt/*]   Any ideas on this fix? ... View more

I am having an issue with the initial configuration to generate LDAP queries. In the GUI i have my settings as such  Anyone that is a splunk admin have any idea on how to make the ldap queries work? I have tried the configurating via the add on for active directory and my ldap.conf file is set as [ADS] alternatedomain = abc.bcd.com basedn = dc=ads,dc=abc,dc=com binddn = CN=SplunkUser,OU=Service Accounts,OU=User Accounts,DC=ads,DC=abc,DC=com port = 3269 server = x.x.x.x ssl = 1 however, with the test connection, it does not work.  ... View more