I will try it later, and I will let you know the result. thanks! ... View more

Thanks you , I will try later ... View more

Create a view in your database that has the latest table, then get splunk to index the view ... View more

aakwah's answer is valid, I'm just providing some official links. Data Cloning in the splexicon and/or also refer to the configure data cloning section of outputs.conf ... View more

I aplogized that I didn't described the question properly. you're right about there is not "Reg_" in the name. I want to monitor the file within .txt at [monitor:///path/to/files/*.txt], and there are hundred of files with [number_Packet_year_month_day] format, and I want to monitor all of the files excluded the "0_Packet_year_month_day.txt" file. It doesn't work in your first suggestion blacklist = \d{1}_Packet_\d{4}-\d{2}-\d{2}\.txt caused it will block the file within 0's name, like 40100, 40110...etc, too. About the second suggestion, it is not data in the file, however, is the file's name. So the props.conf doesn't help in this case I guessed. Here is a regex online website, and I put my example on there. I screenshot the result applied your blacklist regex cmd, but it doesn't work. Result: https://www.dropbox.com/s/8is9hhmlz7ye0v8/0_reg%20blacklist.png?dl=0 ... View more

Does anyone know what causes this. I have never seen this before until now. Unix team deployed UF to around 20 systems and they all had the same GUID. ... View more

Users private knowledge objects should be stored under /opt/splunk/etc/users/ directory. If Splunk Web does not seem to be able to list some users and their knowledge objects, it could indicate an issue at this level? Are you able to check if that directory exists on the filesystem for one of the user that is subject to the problem? Taking a saved search for example (still for one user with the problem), can you find in which configuration file it is residing using btool: /opt/splunk/bin ./splunk btool --debug savedsearches list "<savedsearch>" Another idea could be to run a the following SPL rest: | rest /services/authentication/users Eventually you could get an error message that could help find the issue. Finally I would suggest searching _internal logs for errors. Users and saved searches panels are populated using rest api calls, so you may see errors in there that could help too. A last one, if possible: temporarily remove one of the 50 first users and see if user 51 (now 50) behaves properly. ... View more

Hi, are you using the built-in jTDS driver? It's got a lot of limitations, and you'd probably have better luck using the Microsoft driver. ... View more