Any file which is greater than 25 MB in size while processing in the Universal Forwarder will be automatically assigned to BatchReader. This is answered below already https://answers.splunk.com/answers/109779/when-is-the-batchreader-used-and-when-is-the-tailingprocessor-used.html ... View more

Setting it in the default stanza should enforce that restriction for all users. That might be something you can look into. ... View more

Agreed - we also send to a centralized syslog server running a heavy forwarder. This allows us to do per-event filtering, since our network admins want to keep way more firewall logs than we actually wanted to index in Splunk (or have the licensing for!) ... View more

I'd like to see this "bug" fixed. Its annoying that you need to put it in etc/apps dir and not somewhere else as dictated by the targetrepositorylocation option. It's makes the tiered deployment servers "messy" as to what is a local app and what is deployed elsewhere. For all intents targetrepositorylocation is broken. What we've actually done is to make a deployment "bundle" dir inside the app itself that we then refer to as the repository location. ie. ~/etc/apps/deployment-apps/some_other_app_to_deploy and have "stateOnClient = disabled". ... View more

I took a look at the Splunk_TA_nix 5.1.2 script rlog.sh and made a change to it: I got rid of the grep -v part so the line that reads: awk -v START=$SEEK -v OUTPUT=$SEEK_FILE 'NR>START { print } END { print NR > OUTPUT }' $AUDIT_FILE | tee $TEE_DEST | /sbin/ausearch -i 2>/dev/null | grep -v "^----" no reads awk -v START=$SEEK -v OUTPUT=$SEEK_FILE 'NR>START { print } END { print NR > OUTPUT }' $AUDIT_FILE | tee $TEE_DEST | /sbin/ausearch -i 2>/dev/null This will give you a delimiter for the events which is the "----" Then I made my own sourcetype for this: [linux:audit] BREAK_ONLY_BEFORE = ---- DATETIME_CONFIG = MAX_TIMESTAMP_LOOKAHEAD = 23 NO_BINARY_CHECK = true TIME_FORMAT = %m/%d/%Y %T.%3 TIME_PREFIX = msg=audit\( category = Operating System description = Auditd Events disabled = false pulldown_type = true Seems to be working in my lab for now. Thanks @foxyfred for the idea. ... View more