I am also having this issue and I was unable to resolve by disabling sos_refresh_splunk_servers_cache and hitting the debug/refresh?entity=admin/views endpoint, however I am using a DS to deploy SOS to my SHP and suspect that whatever the endpoint is changing isn't being persisted because the DS is overwriting the change after the next phone home. Can you tell us what the endpoint is actually doing? I could disable my deployment client and troubleshoot that way, but it would be nice to know what we are actually doing here 🙂 I am using the latest version of sideview and sos (3.2.1) on splunk 6.2.1 using SHP+Mounted Bundles and a DS to deploy sos to the SHP. ... View more

You're looking for a regular expression to parse out each line into a variable fieldname according to the key? First, to get the variable fieldname, you need a props.conf and transforms.conf entry like in this question: http://splunk-base.splunk.com/answers/23409/dynamically-extract-field-names-from-multiline-event Second, the regular expression would look something like this (untested): ^([A-Z_]+)\s+(.*) ... View more

Awesomeness! ... View more

FYI this post is from over 3 years ago! Splunk indexes.conf.spec * Default: volume:_splunk_summaries/$_index_name/datamodel_summary, where "$_index_name" is runtime-expanded to the name of the index The max volume size I checked in 8.0.0 appears to be unlimited, I will remove the 100GB per index comment, and I've updated my above post. ... View more

A late response but maybe someone else will have this problem. Our search head (not license master) was always showing these messages. To remove do this: edit: $SPLUNK/etc/system/local/web.conf Add this: updateCheckerBaseURL=0 will also remove any "upgrade version now" messages. We felt that our users did not need to see any of this sort of stuff, only really admins should care about it. ... View more

"what if you are trying to send the Indexer's logs to other indexers, for redundancy?" That's our need; we send our logs to more than one indexer. What other method do you suggest, especially when dealing with Windows Event logs. ... View more