I have logs coming in that are either straight text (single line) or text with a JSON string as well. I have no issues with the straight text, but if there is additional JSON, the event breaks on an attribute with a date. If the JSON has no additional date, it appears to be OK. Sample log event with JSON 2018-11-28T11:25:32.876+0000 STDIO [INFO] 2018-11-28 11:25:32 [Thread-3-ESWriterBolt] DEBUG BaseBolt - { "attribute1": 243, "attribute2": "Standard", "attribute3": 2018-11-28T13:11:45.3720", "attribute4": "Y" } Everything up to attribute2 reads fine, however, attribute3 starts a new event, timestamped with the date value there, and going until the end, or until potentially another date field. The current props.conf for this log type just parses a few fields and also includes TRUNCATE = 0 for no truncation of these events. What additional to I need to setup in props.conf to make this work? Thanks! ... View more

Our instances of Splunk 6.0 will have no access to the internet. I have already added the following the web.conf: [settings] updateCheckerBaseURL = 0 userRegistrationURL = docsCheckerBaseURL = to keep Splunk from reaching back. My question in the Search Dashboard has buttons to get Documentation, Tutorial and in the footer links to the Splunk site. My users are going to try and click these buttons. Is there any way to remove these from the Search dashboard? Thanks! ... View more

After we upgraded from 4.3.4 to 5.0.1, in out Splunk output streams we started receiving the following unwanted events: ForwardInfo build=143156 version=5.0.1 os=Linux arch=x86_64 hostname=<serverName> guid=A5E34FA-C8AC-4A52-A59B-5660FDA25F94 fwdType=full ssl=false lastIndexer=None We are sending the output streams to another application which packages them for delivery to a Splunk instance on another isolated network. Here are some snippets from our outputs.conf [tcpout] indexAndForward = true defaultGroup = nothing [tcp:nothing] disabled = false server = <false server name> dropEventsonQueueFull = 1 [tcp:server1] server = appserver1:port, appserver2:port autoLBFrequency = 88 sendCookedData = false heartbeatFrequency = 0 [tcp:server2] .... This allows outputs events by server and allows us to keep this data separated into different files for events coming from different servers. We have tried some other permutations: a. Removing the defaultGroup This removed the ForwarderInfo messages, but added audit log messages, which were more frequent b. Remove the defaultGroup and add whitelist and blacklist to the tcpout stanza forwaderindex.0.whitelist = .* forwaderindex.1.blacklist = _.* forwaderindex.2.whitelist = _whatever This removed the audit logs and ForwardInfo events, but now all log events went to each output file, which is not what we are looking for either. Anyone have any idea on removing the ForwarderInfo without adding anything to the stream? ... View more