Usually first few line have issue, I suspect the Application still writing the log to the log file but splunk try to read the log file Can we setup splunk to wait ? ... View more

usually the first few line have issue, i suspect the application still writing the log file but splunk already try to read it. ==================================================================================== \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 Date: 2018-12-20T00:00:00.146Z Fields: date-time,client-ip,client-hostname,server-ip,server-hostname,source-context,connector-id,source,event-id,internal-message-id,message-id,recipient-address,recipient-status,total-bytes,recipient-count,related-recipient-address,reference,message-subject,sender-address,return-path,message-info,directionality,tenant-id,original-client-ip,original-server-ip,custom-data ==================================================================================== Any method to fix it or let splunk wait the application finish writing first ... View more

Recently, we found one data input for receiving syslog was stopped. We don't know if the service issue is auto stop or someone disabling it. i tried to search index=_audit, Also, I even saw some log edit server, only see the action is edit server but it didn't mention what setting had been changed. ... View more

i used web to setup the folder monitor settng -> Data inputs » Files & directories » but in the whitelist if i *.csv , it wont index even the file extension is csv. i saw the doc is to edit inputs.conf but in the system/local/inputs.conf i cannot find the folder path i setup in web. so dont know where it is Thanks ... View more

i have a field have space . e.g "product name" and i found out that if i want to add the field in pivot , which is not allow field name contain space How can I rename all field in that index from "product name" to "productname" Thanks ... View more

i have a dashboard, in the click.value will have a string value (e.g 20182010) and then below have another line chart, but how can i put the token to that search e.g index=test earliest=$token_date$ i think the $token_date need to use strptime to convert and then pass to search. but how? Thanks ... View more

i search in splunk , seem that foreach cannot pass the '>FIELD<' into Subsearch , i search that have to use map command i have below search , could someone help me change to map search? index=test code IN (1,3) | foreach 1 3 [ eval code< >= [search index=test code=< > | eval c= price|return $c ]] Thanks ... View more