Hi, I'm bring SRX data into Splunk but the fields aren't getting extracted by the Juniper Add-On. Can the Juniper Add-On parse SRX logs? And if so, what could be the issue? The logs are coming in, but its not searchable since there's no field extractions. ... View more

Currently I'm trying to utilise the Windows Infrastructure app to monitor group changes, however when I go to the dropdown menus they are severely limited but when I run the search by itself I get many results. Is there a reason for this? Is there a way I can get the app to more accurately reflect the search results? ... View more

Hi, I've created an app to be able to monitor some directories for two hosts. The stanzas are completely identical except for the directory path. Is there a way to specify in the inputs.conf which host uses which stanza? ... View more

I keep getting these two errors when restarting the forwarder: ERROR TailReader - File will not be read, seekptr checksum did not match File will not be read, is too small to match seekptr checksum I'm consuming multiple logs in the one stanza, and all of the logs either have one or both of these error messages. I am at a complete loss on how to fix this issue and its beginning to greatly frustrate me. Here is my current inputs.conf for reference:   ... View more

Hi, I want to extract the timestamp from my log and make it the official _time in Splunk and I'm having difficulties doing that. I'd like to keep the date current as there is no date in the log files. This is an example of what a log looks like with the Splunk time: And this is my props.conf: I just want the time in the logs to match the time in Splunk, and I am not sure what I am doing wrong. Please help ... View more

Hi, As admon collects changes to the ad and these events are replicated to all other DCs we have then got duplicate events from multiple DCs that are otherwise the same in every way apart from host. Is there a way besides just disabling it, to collapse these events together? ... View more

Hi, Recently I set up the windows infrastructure app, the windows add-on and the ad-support. However, for some reason even though in the Check Data step of configuring Windows for Infrastructure comes back positive to have detected the relevant sourcetypes, when moving on to Customize Features suddenly none of them can be found e.g. Windows Events not found. I am at a complete loss as to why, especially since I followed the documentation to the letter and have changed all the relevant .conf files to reflect the indexes, etc. Any help would be appreciated as I am absolutely pulling my hair out over it. ... View more