is something like this correct? props.conf [default] TRANSFORMS-routing=alldata transforms.conf [alldata] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT=newgroup outputs.conf [tcpout] defaultGroup=oldgroup [tcpout:newgroup] server=server = xxxx.xxxx.xxxx.:9997 [tcpout:oldgroup] server=xx.xx.xx.xx:9997 ... View more

So, please, what is the right solution, Filtering data is not for me, is there an example avaliable for my need please? ... View more

I wanna forward all data from a hf to two splunk instances, not only something.  ... View more

Cannot I just use multiple defaultGroup? How do I refer to all data in a props? For source host or source type.    Thanks  ... View more

Hello, please could you detail your problem a bit more? I am facing the same issue for a customer, the data before two weeks ago has disappeared, even if the resto of data belonging to _internal index is still online. Thanks and best regards. Luca ... View more

Ciao Giuseppe, thanks for helping, but I have to apologize, because my question was not well explained. I have an environment with only one search head and I would like to move to a cluster environment; there are not other search heads at the moment. I know that at the end I should have 1 deployer and 3 search heads, but, as told above, for the time being I have only one server: a search head. Thanks again. ... View more

@jamie00171  @Roy_9 , thanks for answering, Probably you are right, there's lack of disk space, but the actual issue is that the user gets a "Queued" message, for example, for every dynamic drop down input field in a dashboard and that makes him "crazy" and angry, because it is not true that searches are "Queued". Searches are simply impossible to be executed, even if the user reloads the page. Do you know a way to monitor per user disk utilization? Is it possible to build some kind of dashboard that represents the percentage of disk quota being used by a user in the last 5 minutes? Thanks a lot and best regards. Luca ... View more

Hello, Please, have you solved your issue or got some clues? Thanks.  ... View more

thanks for your example, but I am facing some difficulties in importing a little complex js file that expose some functions. The complete code is here This is the beginning of the js file:  !function(t, e) { "object" == typeof exports && "object" == typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define("cronstrue", [], e) : "object" == typeof exports ? exports.cronstrue = e() : t.cronstrue = e() }(globalThis, (function() { return (()=>{ "use strict"; var t = { 794: (t,e,n)=>{ Object.defineProperty(e, "__esModule", { value: !0 }), e.CronParser = void 0 [...] The end of the code is this: , e = {}; function n(r) { var o = e[r]; if (void 0 !== o) return o.exports; var i = e[r] = { exports: {} }; return t[r](i, i.exports, n), i.exports } var r = {}; return (()=>{ var t = r; Object.defineProperty(t, "__esModule", { value: !0 }), t.toString = void 0; var e = n(728) , o = n(336); e.ExpressionDescriptor.initialize(new o.enLocaleLoader), t.default = e.ExpressionDescriptor; var i = e.ExpressionDescriptor.toString; t.toString = i } )(), r ); })(); });   How can I import this, please?   Thanks a lot in advance. Luca Caldiero ... View more

Hello, thanks for your example, but I am facing some difficulties in importing a little complex js file that expose some functions. The complete code is here This is the beginning of the js file:      !function(t, e) { "object" == typeof exports && "object" == typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define("cronstrue", [], e) : "object" == typeof exports ? exports.cronstrue = e() : t.cronstrue = e() }(globalThis, (function() { return (()=>{ "use strict"; var t = { 794: (t,e,n)=>{ Object.defineProperty(e, "__esModule", { value: !0 }), e.CronParser = void 0 [...]     The end of the code is this:     , e = {}; function n(r) { var o = e[r]; if (void 0 !== o) return o.exports; var i = e[r] = { exports: {} }; return t[r](i, i.exports, n), i.exports } var r = {}; return (()=>{ var t = r; Object.defineProperty(t, "__esModule", { value: !0 }), t.toString = void 0; var e = n(728) , o = n(336); e.ExpressionDescriptor.initialize(new o.enLocaleLoader), t.default = e.ExpressionDescriptor; var i = e.ExpressionDescriptor.toString; t.toString = i } )(), r ); })(); });       How can I import this, please?   Thanks a lot in advance. Luca Caldiero ... View more

Hi, I am facing the same problem. Please, have you found a solution? Thanks in advance. ... View more