Oh brilliant, thank you. ... View more

I had this exact issue, but I am on a clustered search head and clustered indexer environment. I fixed this by moving the splunk_app_cef/bin folder and the splunk_app_cef/default/commands.conf to the Splunk_TA_cefout app on the indexers and it resolved my issue. ... View more

I had this exact issue, but I am on a clustered search head and clustered indexer environment. If you run the search command manually (go to Search Head -> Settings -> Searches, Reports, and Alerts -> App: Splunk App for CEF -> Run ) you get the same error as https://answers.splunk.com/answers/538377/splunk-app-for-cef-how-to-resolve-error-search-fac.html -- "Search Factory: Unknown search command 'cefout'". To fix this I moved the bin folder and the commands.conf to the Splunk_TA_cefout app on the indexers and it resolved my issue. ... View more

I was able to bypass this by configuring the template filter of the destination to "$MSGHDR$MSG\n": destination d_splunkdata_netscaler { file("/<PATH>/$HOST/logs.${YEAR}.${MONTH}.${DAY}" create_dirs(yes) dir-group("splunk") dir-owner("splunk") dir-perm(0744) template("$MSGHDR$MSG\n") ); }; ... View more