The issue here is that you have overlapping monitor stanzas. The * in the source implicitly tells Splunk to monitor files in /home/gcaaxfer/data/ for both, resulting in the overlapping stanzas and only one of them being read. The recommended approach to solve this issue is to create one stanza in inputs.conf to read in both sets of files and also deploy a props.conf within the same add-on on the Forwarder to specify the sourcetype based on the source. As follows: inputs.conf: [monitor:///home/gcaaxfer/data] whitelist = (*NR*.csv | *ticket*.csv) host_segment = 3 index = my_index disabled = false props.conf: [source::.../*NR*.csv] sourcetype = request_nr [source::.../*ticket*.csv] sourcetype = request_ticket Now that you've assigned them to separate sourcetypes, you can easily update your props.conf on your Indexers and/or Heavy Forwarders to properly perform the separate time extractions. ... View more

A) Create a preprocessor program in any language that will aggregate the data and create a single event. B) Add the events to a temporary index that rolls off in a few hours or days, then create a summary index using that temporary index as input. ... View more

The newest version works on XP. ... View more

Apologies for not being clear. That's the README on the ../bin/ directory, I was referring to the README.txt on the apps' main directory. Just one up from that one. Its contents start with '# Splunk/NetWitness REST API Session Meta scripted input '# Version : 0.9.1 '# Date: 12 Dec 2012 Unfortunately, it's too big to post here. ... View more

I downvoted this post because spam content. ... View more

You can try replace function of eval for a single field eval n=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/") Else rex will solve your problem 100% rex mode=sed "s/\"\"/\"/g" ... View more

_TCP_ROUTING is used to send data to another indexer. If the data is already at the indexer you want, just use the _MetaData:Index key to change the index for that event. [FromFoo] REGEX = (?i) From|.+?Foo DEST_KEY = _MetaData:Index FORMAT = foo_index [FromBar] REGEX = (?i) From|.+?Bar DEST_KEY = _MetaData:Index FORMAT = bar_index ... View more

Can you send to me too please ... View more

OK , thanks Damien, I'll give the lookup tables a try... ... View more

If you are a new user, then it may not work, or there may be no option for sending the test mail. You may send test mail after verifying the information. please visit Gmail Support USA for more information. ... View more

There is some pretty good documentation on this topic here: http://commons.oreilly.com/wiki/index.php/Snort_Cookbook/Logging,_Alerts,_and_Output_Plug-ins ... View more

Hmm... I believe this script it a bit dangerous. What happens, if you have 3 events (one unique and two, which is duplicates) within the same second? Then the script will delete one of the duplicates AND the single unique event, right? ... View more

https://answers.splunk.com/answers/453991/find-the-duplicate-files-from-particular-source-in.html ... View more

As a note for people using relatively recent versions of Sideview Utils (currently 2.2.9), you can also very easily configure its SearchControls module to show only the "export" button, and then you don't need any custom CSS. This is significantly easier than using ResultsActionButtons and patching its CSS. SearchControls has been out for a long time, releasing back in the 2.1.X days. Note that the Sideview Utils on Splunkbase is only 1.3.5. http://sideviewapps.com/apps/sideview-utils ... View more