Hi @ITWhisperer ,  I have tried this method. The host name on the log is structured like "hostname.abcgroup.com". I want to search like, "hostname*". Since, the hostnames are retrieved from lookup it's working as a static string search. Not filtering the host. I tried like this after get the data from lookup, | eval host_pattern=host."*" | table host_pattern But, this is also not working. I guess the Splunk may consider the wildcard * as string. Since, I am filtering like this. Any suggestion for this... ... View more

Hi @livehybrid/@PrewinThomas  , Yes, The linux server is a VM running on azure. I am checking the access and availability of the file as mentioned. Will let you know once I'm done.  The Splunkd event, 06-13-2025 19:30:53.923 +0000 ERROR AggregatorMiningProcessor [3844932 structuredparsing] - Uncaught exception in Aggregator, skipping an event: Can't open DateParser XML configuration file "/opt/splunkforwarder/etc/datetime.xml": No such file or directory - data_source="/opt/splunkforwarder/var/spool/splunk/tracker.log", data_host="-----", data_sourcetype="splunkd_latency_tracker" 06-13-2025 19:28:30.171 +0000 ERROR ExecProcessor [3844925 ExecProcessor] - message from "/opt/splunkforwarder/etc/apps/pwc_west_ghs_uf_nix_v2/bin/package.sh" /bin/sh: 1: /opt/splunkforwarder/etc/apps/pwc_west_ghs_uf_nix_v2/bin/package.sh: not found 06-13-2025 18:28:29.084 +0000 ERROR ExecProcessor [3844925 ExecProcessor] - message from "/opt/splunkforwarder/etc/apps/pwc_west_ghs_uf_nix_v2/bin/hardware.sh" /bin/sh: 1: /opt/splunkforwarder/etc/apps/pwc_west_ghs_uf_nix_v2/bin/hardware.sh: not found Is possible to narrow down the issue with these events? Thank you. ... View more