What @richgalloway said, @johnhsu! ... View more

I have same issue with Version 6.6.2 and 6.6.3 ... View more

try the sedcmd command in the props.conf, and deploy on your parsing instances : see http://docs.splunk.com/Documentation/Splunk/6.1.4/Data/Anonymizedatausingconfigurationfiles on all indexers on all heavy forwarders in case of csv/iis or INDEXED_EXTRACTION sourcetypes (since splunk 6.1), on the forwarders (even the Universal and Lightweight) [mysourcetype] SEDCMD-hidessn=s/(GovernmentIDNumber: SSN: \d{3})(\d{6})/\1xxxxxxx/g GovernmentIDNumber: SSN: 555666666 -> GovernmentIDNumber: SSN: 555xxxxxxx ... View more

Remove tons of session files ll | grep session | awk '{print "rm "$8" "}' | csh Note: "$8" -- column 8 of ll comand Thanks Sincerely John Hsu johnthsu@hotmail.com ... View more