In case this was never resolved, or for others who are interested, the solution here is to use multiple transforms stanzas to bring the total size under 8190, like so: props.conf: [my_sourcetype] TRANSFORMS-index_routing = ruleset1, ruleset2 transforms.conf: [ruleset1] REGEX = (cat.*dog|rat.*count) FORMAT = sample1 DEST_KEY = _MetaData:Index [ruleset2] REGEX = (computer.*calculator|computer.*device.*v2) FORMAT = sample1 DEST_KEY = _MetaData:Index  I would also argue in this specific case a different approach should be used as a regex this sizable will cause high CPU overhead during ingestion, especially if the source is high-volume. ... View more

Still works in 2021, except look in python3.x folder instead of 2 ... View more

The core Splunk Enterprise functionality does not use OpenJDK but included the jar to support DFS. If you do not use DFS, the Splunk Enterprise application does not use or load OpenJDK, and the jar does not pose a security risk to your instance. Splunk Enterprise removed OpenJDK in 8.1.0 and later. See https://docs.splunk.com/Documentation/DFS/latest/DFS/InstallationChecklist for more info. However, updating from older versions does not remove it. If you do not use DFS or do not plan to use DFS, regardless of your Splunk version, feel free to delete the file folder in SPLUNK_HOME/bin/jars or SPLUNK_HOME/bin/jars/vendors/java. The jars files in SPLUNK_HOME/etc/apps/splunk_archiver/java-bin/jars propagates from SPLUNK_HOME/bin/jars. In the background and on running the command |archivebuckets forcerun=1, splunkd copies all jar files from /bin/jars to splunk_archiver. However, splunk_archiver does not use OpenJDK and the jar does not pose a threat to your instance. Deleting the file from the main folder and restarting Splunk should delete it from splunk_archiver. Running |archivebuckets forcerun=1 forces the operation. If your environment uses DFS, you can manually update/replace OpenJDK with a newer version. Keep in mind, DFS EOLs in October 2021. ... View more

(Old question with an answer still valuable) In a SHC the SH resources are not shared among searches, but for scheduled searches. Ad-hoc searches running on a SHC member will consider the cpu cores and memory resources as if it was unique.  For the scheduler, the captain will mitigate starvation by distributing scheduled jobs to available members. Each member not being supposed to consume more than its capacity. So you give more resources to scheduled jobs automatically in a SHC,  while for adhoc searches it depends on where the users are logged in. A load balancer for users connections can help, for high availability: users don't need to know each member fqdn nor ipod address to get in.  ... View more

Thanks. It worked. ... View more

@doweaver If this solved your problem it'd be great if you could mark this as Answered, just to help others in the future. Cheers! ... View more

@saifullakhalid, can you please confim whether it worked or not? ... View more

Yes the evt_resolve_ad_obj has been set to 1 but it is still in SID form instead of friendly naming... This happens for Windows 2000 and XP ... View more

@wenthold is correct - the field extraction engine is adding the ?ms flags to the start of the regex in your props.conf file. This means that your regex is matching on the whole event as though it's a single line. This can be seen in the documentation too: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in-answer&utm_term=props.conf&utm_campaign=refdoc#Field_extraction_configuration If your aim is to only extract the target account, I'd recommend using something like the following regex, which will work in field extractions or in the rex command: (?m)Target\sAccount:\n?(?:(?!Changed).+?)\n?Account\sName:\s(?<target_user>.+?)\n?Account This will also block capture of the rest of the event if the field is empty or all on one line, which is what's happening for you at the moment. ... View more

You should be able to edit your answer to update the text. When writing code, put four spaces before each line to convert the text into a code block - this prevents your text from being modified automatically. ... View more

You can try adding white space by modifying the XML code. Create panel IDs for identification purposes. <form> <row> **<panel id="id_one">** <chart> <search> <query></query> </search> <option name=""></option> </chart> </panel> </row> <row> **<panel id="id_two">** <chart> <search> <query></query> </search> <option name=""></option> </chart> </panel> </row> Create a new HTML panel which will hold code for the spacing by going to Edit>Edit Source>XML. Note The token hiddenForCSS is used to hide the styling panel. Use the ID for a panel you want to add white space. Padding-bottom will be used to space out the panels by 10 pixels. Note !important is used to override the default setting. <row> <panel> **<html depends="$hiddenForCSS$">** <style> **#id_one .panel-body { padding-bottom: 10px !important; }** </style> </html> </panel> </row> </form> This is what it looks like before: This is what it looks like afterwards: ... View more

Instead of avg() you can use sum(), like so: - | eval esize=len(_raw) | stats sum(esize) as bytes by sourcetype ... View more