"The "splunktcp" input is not a "data" input, but instead an input to listen to Splunk Forwarders." Thank you, this clarified the problem for me as I was experiencing the same issue. ... View more

I had a similar use case with PDFs. I finaly wrote a script to generate the saved searches and schedules based on a template and csv of parameters. http://answers.splunk.com/answers/200640/how-to-schedule-customized-dashboard-views-to-grou.html Maybe you can hack it to fit your use case. ... View more

The pipe was missed when I posted the query, however it's present in my config spec. Any other possibilities? Also, does splunk not allow to 2 or more stanza with the same monitor line, eg. monitor::/var/log monitor::/var/log with different files in the whitelist? ... View more

I have one more question. When I am trying to push the indexer data from srch head to 2 indexers. None of the time the data got pushed in the same time. There is always a delay of 2-3 hours. Like srch hed started pushing data to Indx_01 at 10:00 and for Indx_02 it is 11:30.. is there any cause behind that? ... View more

This worked for me as well, thanks! ... View more

Missing slash. Ouch. The %e space pads and works fine. I can confirm that the following following config in props.conf works: TIME_FORMAT=%e/%m/%g %H:%M:%S TIME_PREFIX=[(] ... View more

We have Splunk Enterprise 7.0.0. I have a multiline event I am trying to configure a sourcetype for and was able to successfully test using regex101.com but I do not get the results in Splunk when setting up the sourcetype. This example log has 400+ lines. I know the word to start and the word to end the match for the event. I just need to match the lines started with PRPM down to the line with the word END. I should also note that I had to add the MAX_EVENTS due to the length of the event data. Example: PRPM*28 blah blah blah blah blah blah blah blah blah ........blah blah blah .... ..blah blah END This works on REGEX101.com but not in Splunk. (?s)^PRPM(.*?END) I also tried with (?m). Suggestions? ... View more

Try using [nessus_plugins] BREAK_ONLY_BEFORE = ^# ... View more

Thank you so much! (?m-s) does get this working. ... View more

Pretty sure that there is no way to do this when the outputcsv command is called to generate the csv file with events from your search results. I would recommend using a script to clean up the CSV file after its been generated for which SED would be useful or using batch/cmd/powershell on Win systems. ... View more

Thanks @himynamesdave for sharing the updated link ... View more

This fixed the issue ... View more

no nothing different, it's simply that the examples use the standard port. You can have many TCP listening ports with or without SSL encryption configured. ... View more

linux by default uses MD5 to hash the etc/shadow file. ... View more