Thank you! But, not knowing Python, I burnt some cycles on the adding of "local=True" to things already there. To help my next comrade from not falling for this, but sure to use a comma to separate multiple entries in the Configuration parameters. I.E.: ldapsearch.py:@Configuration(retainsevents=True, local=True) ldaptestconnection.py:@Configuration(retainsevents=True, local=True) ldapfetch.py:@Configuration(local=True) ldapfilter.py:@Configuration(local=True) ldapgroup.py:@Configuration(local=True) ... View more

it's because you have spaces in the fields. A different output format might work. ... View more

You can create a transform that sends the events to the nullQueue from the your blacklist by matching the source value. Example: This will ignore all events from a zip archive that are README.txt files in transforms.conf example: [archived_file_blacklist] SOURCE_KEY = MetaData:Source FORMAT = nullQueue DEST_KEY = queue REGEX = (README)\.txt$ in props.conf example: [zip_archive_sourcetype] TRANSFORMS = archived_file_blacklist in inputs.conf example: [monitor:///Users/myuser/zipfiles/*.zip] sourcetype = zip_archive_sourcetype ... View more

You could build an SEDCMD setting in props.conf to replace your NUL with a different char... not quite sure if that happens before or after escaping though, so you may need to look for both escaped and unescaped NULs and replace both. ... View more

I am having the same issue ... View more

Hi @tsomod, could you please make a new question and give an example of the events so we can help you out ? ... View more

2/2016, this issue of java 8 with SQL server is still not fixed! ... View more

thank you, this works perfect! ... View more

In addition to setting up your inputs.conf as described by martin and mdonnelly. I also had to copy palettesearches.conf into my local directory, edit these sections and restart splunk instance. [NetworkMonitoring.OutboundHosts.Search] search = index=windows sourcetype=WinNetMon host="$NetworkHost$" Direction=outbound earliest=-60m | top limit=10 RemoteHostName use_timepicker = 1 [NetworkMonitoring.InboundHosts.Search] search = index=windows sourcetype=WinNetMon host="$NetworkHost$" Direction=inbound earliest=-60m | top limit=10 RemoteHostName use_timepicker = 1 [NetworkMonitoring.OutboundProcesses.Search] search = index=windows sourcetype=WinNetMon host="$NetworkHost$" Direction=outbound earliest=-60m | top limit=10 ProcessName use_timepicker = 1 [NetworkMonitoring.InboundProcesses.Search] search = index=windows sourcetype=WinNetMon host="$NetworkHost$" Direction=inbound earliest=-60m | top limit=10 ProcessName use_timepicker = 1 updating eventtypes.conf like this was not enough or did not work. [windows_netmon] search = index=windows sourcetype="WinNetMon" Our server details. Splunk Version: 6.2.0 Splunk Build: 237341 Current App: Splunk App for Windows Infrastructure App Version: 1.0.4 App Build: 234279 ... View more