I made a dashboard for this.  Works fine even in a distributed setup with many search head.   <form theme="dark"> <label>Current online users</label> <!-- 1.0 #jotne 09.02.2021 --> <search id="base_search"> <query> index=_audit NOT user IN (n/a splunk-system-user) NOT "scheduler__nobody__search" host="$Server$" user="$User$" | fields timestamp host user </query> </search> <fieldset submitButton="false"> <input type="time"> <label></label> <default> <earliest>-60m@m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="Server"> <label>Server</label> <search base="base_search"> <query> | eval data=host | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="dropdown" token="User"> <label>User</label> <search base="base_search"> <query> | eval data=user | stats count by data | eval info=data." (".count.")" | sort -count </query> </search> <choice value="*">Any</choice> <fieldForLabel>info</fieldForLabel> <fieldForValue>data</fieldForValue> <default>*</default> </input> <input type="radio" token="sort"> <label>Sort by</label> <choice value="host">Server</choice> <choice value="user">User</choice> <initialValue>host</initialValue> </input> </fieldset> <row> <panel> <chart> <search base="base_search"> <query> | timechart count by $sort$ </query> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> <option name="height">300</option> </chart> </panel> </row> <row> <panel> <table> <search base="base_search"> <query> | stats latest(timestamp) as last_seen by user host | sort - last_seen</query> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="user"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> </row> </form>     ... View more

TCP inputs are not allowed in Splunk Cloud at all so you must have an on-prem instance to do it. Another respondent says UFs can listen for TCP input.  Try it.  If it doesn't work, use a HF.  If your customer can run a UF they probably can run a HF. ... View more

Hello Nelton, Use the "Add comment" function when replying instead of posting a new answer. Regarding your second question: Your logs contain a UTC timestamp. Splunk Web will display your local time zone. I guess for you that is GMT+1. (You can view/edit your user's time zone if you click on your username at the top and then click on "Preferences".) Regarding your first question: Splunk can automatically extract the header and create the corresponding fields. See Extract fields from files with structured data. However, that only works for file-based inputs and for the "Upload" function in Splunk Web. Add the "FIELD_DELIMITER" and "HEADER_FIELD_DELIMITER" configuration: https://ibb.co/3rjcBLV Splunk complains that the header contains 9 fields whereas the other lines contain 10 fields. You could also configure field extractions at search time instead at index time like shown here. ... View more

Thanks a lot... That worked ... View more

Best is to create a small app, that contains the relevant props.conf and transforms.conf and push that to all indexers in the cluster from the cluster master. http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations ... View more

What do you mean by I cannot see ? What exactly are you doing to see ? ... View more

Hi neltonk,, You can use Master Node ONLY to deploy Apps to Indexers, not to other systems as Search Heads. On stand alone Search Heads you can only manually install apps (really you could use a Deployment Server but it's mad!) Let me know your architecture: you have two clustered Indexers, a Master Node that manages the cluster, a stand alone Search Head that is used by the users to query data on cluster, is it correct? If you want to use an App on a Search Head configured to see the data on Indexers Cluster, you have at first to configure SH following the procedure described at http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/Configurethesearchhead . Then you have to manually copy your custom App on SH (using tar or any other way) at $SPLUNK_HOME/etc/apps and then restart Splunk. In this way you have: data on clustered Indexers, App on SH, SH configured to search data on Clustered Indexers. At the end, I don't understand what you mean saying: "I have packaged the app folder from the indexer node and deployed to the SH but this only has app.conf" because you cannot deploy an app to a stand alone SH from an indexer. Bye. Giuseppe ... View more

Thanks a lot for the quick response. I can now proceed with the next steps... ... View more

This line here should extract the data you need... | rex "\"port-id\":\s+\"(?<node>[0-9a-fA-F:.]{21})\",.*?\"address\":\s+ \"(?<address>\d+\.\d+\.\d+\.\d+)/"" Here's an example of one way you could proceed: | makeresults | eval mydata="{ \"node\": {\"port-id\": \"000f:53ff:fe59:f640.1\", \"domain\": 3, \"address\": \"10.0.0.1\" } }!!!!!{ \"node\": {\"port-id\": \"000f:53ff:fe59:f720.1\", \"domain\": 1, \"address\": \"10.0.0.2\" } }!!!!!{ \"node\": {\"port-id\": \"000f:53ff:fe59:f620.2\", \"domain\": 0, \"address\": \"10.0.0.3\" } }!!!!!{ \"rx-event\": {\"monitor-seq-id\": 0, \"monitor-timestamp\": \"2018-01-02 03:24:08.454728\", \"node\": \"000f:53ff:fe59:f640.1\", \"parent-port\": \"ec46:70ff:fe00:be6d.1\", \"sync-seq\": 18218, \"offset-from-master\": -11.000000, \"mean-path-delay\": 1771.000000, \"sync-ingress-timestamp\": 1514863478.454504073 } }!!!!!{ \"rx-event\": {\"monitor-seq-id\": 1, \"monitor-timestamp\": \"2018-01-02 03:24:08.454730\", \"node\": \"000f:53ff:fe59:f640.1\", \"parent-port\": \"ec46:70ff:fe00:be6d.1\", \"sync-seq\": 18219, \"offset-from-master\": -11.000000, \"mean-path-delay\": 1771.000000, \"sync-ingress-timestamp\": 1514863479.454501525 } }!!!!!{ \"rx-event\": {\"monitor-seq-id\": 2, \"monitor-timestamp\": \"2018-01-02 03:24:08.454730\", \"node\": \"000f:53ff:fe59:f640.1\", \"parent-port\": \"ec46:70ff:fe00:be6d.1\", \"sync-seq\": 18220, \"offset-from-master\": -11.000000, \"mean-path-delay\": 1771.000000, \"sync-ingress-timestamp\": 1514863480.454500265 } }" | makemv delim="!!!!!" mydata | mvexpand mydata | rename COMMENT as "The above just creates test data." | rename COMMENT as "This pulls the node and addess off the MAC address mapping records" | rex field=mydata "port-id\":\s+\"(?<node>[0-9a-fA-F:.]{21})\",.*\"address\":\s+?\"(?<address>\d+\.\d+\.\d+\.\d+)\"" | eval killme=case(isnotnull(address),"killme") | rename COMMENT as "This pulls the node off the log entries - you need to do whatever else here that you want for the report" | rex field=mydata "node\":\s+\"(?<node>[0-9a-fA-F:.]{21})\"" | rename COMMENT as "Now we roll the address from the MAC to the log records" | eventstats max(address) as address by node | rename COMMENT as "and kill the unneeded MAC records" | where isnull(killme) | rename COMMENT as "Or you can wait until this point and NOW do whatever else here that you want for the report" ... View more

You could do a rex command using sed mode and have it delete the data that doesn't have the format of the informational lines. That should be easy enough, but I'm not sure what you indexed data is looking like: Is this data showing up in a search as a single event, a set of one-line events, or a mix of one- and multi-line events? If you want to use the old data, then you will have to do search-time modification of the data that is returned from the search. For future data it is possible to remove the lines that don't start with a timestamp, leaving only the valuable data lines. ... View more

Hi neltonk, please try with a different regex in host_regex parameter Linux\\(\w+)_ or D:\\SplunkForwarderCache\\TimeSyncLogs\\Linux\\(\w+)_ backslash is a special char for regexes and must be escaped. Bye. Giuseppe ... View more

Thanks a lot Mayur. That worked... Thanks again for the tip. ... View more

Thanks again Mayur for your help ... View more

New to splunk please help... I have a splunk cluster - 1 Master(also the license master), 3 node indexer cluster, 1 search head. I want to delete data in a specifi index Could you please verify if the following steps are correct to delete event data? On the Master Node : put cluster in maintenance mode stop indexers - splunk stop on each indexer remove data using the command splunk clean eventdate -index xyz - where do I run this command - on each indexer node ? start indexers - splunk start on each indexer On Master Node : disable Maintenance node ... View more