I have a collection of log files that I am trying to parse.  Quick summary: From Apache/Tomcat using logback I don't have permission to change the layout of the log files at the moment but can work on that Event field from the quick parse seems to hold a lot of data that could be separated out into "Fields" via comma separation.   I seem to need the 3rd item in Event if we could parse them by comma Is there an easy way to do that in the query syntax? The Event section looks like: date,  something about a filter, THE URL THAT I WANT, other junk etc 2022-05-01 23:15:24,  calling SSO: null, /topUrl/rest/services/folder/servicename/command?moreinfoEtc, referer: Null, request ip: 10.xxx.xxx.xxx So, I'd love to get statistics on  topURL ServiceName Any help would be great.   ... View more

I am attempting to setup Splunk on a VM that will become a VM template. I have run sysprep and made it a template. I create a new VM from the template, and it receives new machine name and IP address. The problem is that when it reports to Splunk, it has shows up under the old Hostname entry. I see current entries that state : Host: oldName , Computername: oldName and other entries that state Host: oldName, Computername: newName We are forwarding Windows event logs to a master Listener. I see at least 3 places where the machine name is configured. Inputs.conf and 2 different server.conf files. What is the best way for us to automate this? Thanks, Trent ... View more