Hello, same issue in 8.2.2 after upgrading some apps like Splunk_TA_nix or Splunk_TA_oracle, had to do this :   ps -ef | grep -i python siem     11808     1  0 Apr18 ?        00:03:52 /OPT/siem/splunk/bin/python3.7 -O /OPT/siem/splunk/lib/python3.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000 siem     34758 30871  0 12:26 pts/0    00:00:00 grep --color=auto -i python [siem@s201lbasplsh2 ~]$ kill 11808     ... View more

old 4.* and 5.* forwarders protocol is compatible with Splunk 6.* indexers. You can upgrade your key components first : (search-head, indexers, cluster-master, license-master, deployment-server, eventually heavy forwarders). And later upgrade the forwarders. ... View more

You can also use LINE_BREAKER to have multi-line events without using SHOULD_LINEMERGE. We do that a lot since line merging isn't efficient. It's covered pretty well in the docs, but if some one needs help let me know. ... View more

You're throwing away the messages, and not including them again. tcp forwarding occurs in the indexing queue, so you need to alter [setparsing] so that DEST_KEY = queue and FORMAT = indexQueue or FORMAT = parsingQueue Edit You probably then need another transform called setrouting that sets the routing up afer setnull nad setparsing. ... View more

You could define an eventtype for this: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Defineeventtypes Alternatively tags should work as well: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Defineandusetags ... View more

This : ... | stats count will return 0 if there's no results this : ... | stats count by watch will return nothing if there's no results, because there's no 'watch' to split over, you dont get 0 , so the rangemap doesnt have a value. So you need to add a dummy line with lista=0 when appropriate. ... | stats max(count) as lista | appendpipe [ stats count | eval lista=if(count==0,0,NULL) | fields - count ] | ... etc etc. You could move the check forward in the search too, but this is the easiest way to explain it ... View more

I know this is old, but you should notice that security is not perfect when you want users to send events directly to splunk, as you'll have to give excessive permissions to the user that authenticates from the client side. ... View more