Team, I would like assistance with creating regex,specifically to blacklist 1 host name - happens to be the spunk server- very noisy.   Alternately would like direction to site or resource that could help with creation of regex and debugging. I have had no luck- too many hours to quantify.  This was the best so far- but even as submitted (results all green)  regex did not work. http://regjex.com/           ... View more

Team, i wish to utilize Powershell scripts, deployed to remote clients via the GUI interface - or CLI Whichever can be made to work. 1. The CLI (Inputs.conf) works if created and maintained on each client 2. The remote script  GUI only seems to work for bat files. 3. The V3 modular input only seems to work for localhost   History:  i have successfully utilized  powershell scripts with in the inputs.conf (placed on each forwarder) example :    script = . "C:\Program Files\Splunk\etc\apps\My-App\bin\script.ps1 ( I chose to use the full path as the env variable does not seem to stick-- set or setx does not seem to matter) The downfall of this is the script/ inputs.conf has to be updated manually on each client.   i have successfully utilized batch from the GUI (settings > data inputs >remote scripts) $SPLUNK_HOME/etc/apps/_server_app_W64_NETWORK_INFO/bin/netstat.bat Attempts with .ps1 scripts does not work.     Tried utilizing the Powershell v3 Modular Input that method only targets the local host (server)    ... View more

There are approximately 1.5 Billion ingested entries from 40 forwarders. Performing a search with any criteria on Windows hosts lists all events as all-time. Performing the same search on Linux hosts only returns 24 hours of data, regardless of time/date ranges supplied. Each day the data only covers the last 24. What settings could be causing this? ... View more