Hey mate, just wondering how you got along with this? im having the same issue at the moment, i have multiple sites and multiple clustered indexers needing to send to one specific indexer.  ... View more

If you are trying to exclude the event 4625, then you should not use whitelist. Whitelist will include the following pattern. Comments from documentation - https://docs.splunk.com/Documentation/Splunk/7.2.5/Admin/Inputsconf#Event_Log_whitelist_and_blacklist_formats " * Example: whitelist = EventCode=%^200$% User=%jrodman% Include events only if they have EventCode 200 and relate to User jrodman " Just try to use Blacklist if you want to drop EventCode 4625. Maybe try blacklist1 = EventCode="4625" or blacklist1 = EventCode="4625" Type = "(Information)" ... View more

So i ran into the same issue & managed to find a way around. Upon manually executing the script outlined in the log; $SPLUNK_HOME/splunk_app_db_connect/linux_x86_64/bin/server.sh got below issues: ./server.sh: line 33: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/bin/java/bin/java: Not a directory ./server.sh: line 33: exec: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/bin/java/bin/java: cannot execute: Not a directory Seems like the JAVA_HOME variable was being set incorrectly & had an extra /bin/java at the end. Tweaked JAVA_HOME variable in bash_profile & restarted Splunk. DB connect works fine now. . Hence tweaked the variable so that ... View more

@ssadh would it be possible for you to share the Simple XML code for multi-value fields? ... View more