It's just the "-" in your negative lookahead. Currently you will discard anything that ends with "-TEST". You don't have a "-" in your example. This should work: REGEX = (logtype::ABC.*id::IDB-28123.*username::((?!TEST).)*$) Edit: I don't know why two of the "*" weren't showing up. ... View more

In outputs.conf on the forwarders: [tcpout] defaultGroup = prodserver, testserver [tcpout:prodserver] server = [tcpout:testserver] server = From the outputs.conf documentation. "# You can have as many target groups as you want. If you specify more than one target group, the forwarder sends all data to each target group. This is known as "cloning" the data." ... View more

The examples you posted look like you could trust Splunk to find the timestamps automatically. However, if you want to do it manually then you are going to need to create a xml file with the various timestamps and reference it in props.conf. [mysourcetype] DATETIME_CONFIG = /etc/system/local/custom_datetime.xml Documentation ... View more

In props.conf Simplest [syslog_sic] TIME_FORMAT = %Y%j %H:%M:%S.%N Better but with specific regex based on the small sample you provided. [syslog_sic] TIME_FORMAT = %Y%j %H:%M:%S.%N MAX_TIMESTAMP_LOOKAHEAD = 20 TIME_PREFIX = \w{5}\s\w{7}\s\w{4}\s LINE_BREAKER = ([\r\n]+)(?=\w{5}\s\w{7}\s\w{4}\s\d{7}) SHOULD_LINEMERGE = false ... View more

I'll try to be concise as this could be a long answer. When it comes to bootstrapping a Splunk instance you have three different scenarios: search head cluster member, indexer cluster member and everything else. Search head cluster member - Here you have to add the [shclustering] stanza to server.conf. This where conf_deploy_fetch_url is set. This is just the url of the Deployer. But you aren't done yet, the search head needs to be added to the cluster. For that you need the "splunk init shcluster-config ..." command. Now the search head has joined the cluster and will pull everything it needs from the captain. Indexer cluster member - This is the easiest. In server.conf add the [replication_port://] and the [clustering] stanzas. Once it connects to the cluster master it will pull the bundle and restart if necessary. The "splunk apply cluster-bundle" command is used on the master to push out the new bundle to the cluster members. Everything else - A non-clustered indexer, search head, forwarder or heavy forwarder can use a deployment server. Bootstrapping forwarders is a common practice in Splunk and there is Splunk documentation on it here. In this case you need to configure deploymentclient.conf. The caveat is that the deployment server needs to know what to deploy to that new instance. This is where serverclass.conf (on the deployment server) comes in. There you would have separate stanzas for each class, i.e. [serverClass:MyIndexers]. In this stanza you would whitelist or blacklist the clients so they receive the correct apps. Also, there is the "restart splunkd" item which can be used to for the client to restart. In deploymentclient.conf it is also a configuration item with "reloadDSOnAppInstall". A deployment client is very easy to install. The basic install is just: [deployment-client] [target-broker:deploymentServer] targetUri= deploymentserver.splunk.mycompany.com:8089 Taken from deploymentclient.conf. Just make sure the deployment server knows what apps to send it. ... View more