@ssievert sure thank you for your prompt reply. I will try it . My typing queues are getting filled(because of too many extraction rules) very often which is causing downstream queues to get filled too . When i checked my CPU, it is underutilized so I thought if I enable parallelization it will clear the backlogs in pipeline processor. What should I Consider about disk write performance before enabling parallelization? Agan thanks in advance ... View more

consider below configuration. props.conf TRANSFORM-null = setnull transforms.conf [setnull] REGEX = cs\d+Label=(.*?(?=(?:\s[\w.:[]]+=|$))) REPEAT_MATCH = True DEST_Key=queue FORMAT=nullQueue for below kind of keyvalue pair is sending the whole event to nullQueue cs5Label=EventId Any solution? ... View more

index="indexname" | script from the UI ... View more

I used your comment but i get th ebelow error i am not sure why utils/bin/script.py from splunk.Intersplunk import dcu 07-14-2017 16:14:10.376 ERROR ScriptRunner - stderr from '/productos/pentaho/splunk/bin/python /productos/pentaho/splunk/etc/apps/utils/bin/script.py': from ^ splunk.Intersplunk import dcu 07-14-2017 16:14:10.376 ERROR ScriptRunner - stderr from '/productos/pentaho/splunk/bin/python /productos/pentaho/splunk/etc/apps/utils/bin/script.py': SyntaxError: invalid syntax 07-14-2017 16:14:10.376 ERROR ScriptRunner - extern write error: errno=Broken pipe from splunk.Intersplunk import dcu I am not sure whats the syntax error in this . Well your answer helped me in debugging i am getting closed to what i want. ... View more

@MuS I used the same results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() to grab the events from search results but it doesnt work ? any ideas ? ... View more

but i see data being streamed . How can i fix this ?any idea? ... View more

the logs being monitored is in the form of label=labelname value=actual value now the script is intended to convert the above into labelname=actual value at search time. the python script is inside the app. My props.conf and transform.conf are working fine and the fields are getting extracted. when i run this from splunk CLI it gives me error at this line results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() and makes reference to these two function from splunk python library. /splunk/lib/python2.7/site-packages/splunk/Intersplunk.py"", line 336, in getOrganizedResults results = readResults(input_str, settings) File "splunk/lib/python2.7/site-packages/splunk/Intersplunk.py"", line 265, in readResults line = input_buf.readline() ... View more

@khourihan_splunk I checked my logs it has the space as shown below Jul 7 11:21:56 180.189.15.13 CEF: 0|Imperva Inc.|... so I followed the steps mentioned above to modify the regex in cefkv.py at line 11 . here is my modification CEF_DATA_RE = re.compile('CEF:\s\d+|[^|]|[^|]|[^|]|[^|]|[^|]|[^|]|(.*)') I still don't get the expected key value pair can you recommend . ... View more

@IgorB I checked my logs it has the space as shown below Jul 7 11:21:56 180.189.15.13 CEF: 0|Imperva Inc.|... so I followed the steps you mentioned to modify the regex in cefkv.py at line 11 . here is my modification CEF_DATA_RE = re.compile('CEF:\s\d+|[^|]|[^|]|[^|]|[^|]|[^|]|[^|]|(.*)') I still don't get the expected key value pair can you recommend . ... View more

I want to import logs from Imperva DAM ,can I install this add-on UF to format the data and send to indexer? Also what kind of configuration would be required for this? thanks in advance ... View more

yes My cluster is indexer cluster . and other question is that how does splunk handle creation of indexes? like ket say i have multisite indexer cluster where would i create index ? ... View more

Thanks for the response. let's say at 2 nd layer forwarder are intermediate forwarder. This is for data loss in case if one data centre goes down the other takes the data from the universal forwarder and send it to indexer. Does that make more clear? ... View more

Thanks for the quick response I read the documentation for Microsoft active directory add-on . I have a concern regarding configuration of Microsoft active directory add-on with UF. In the current environment the servers of DC are Windows server 2008R2 which requires additional add-on for microsoft powershell. Let say if I install UF on the host machine and install these both add -on on each DC , will this provide knowledge objects which can be used by Enterprise security or these add-on are just good enough for Microsoft Exchange or Splunk App for Windows Infrastructure deployment. Also we are conducting a POC so we don't have any deployment servers to deploy the apps through deployment server. In such scenario do we have to install the both add-on manually on each server ? ... View more

Thanks for the response . we are going to collect all the logs with syslog-ng and UF and sending it to intermediate forwarder which in turn would send data to indexer . ... View more