Currently, we have been getting some warnings in our environment that we are reaching our license quota. Unfortunately, this seems to happen when there is a backlog of events that come in at one time and caused our license quota to be reached. Today we noticed that there were only 2/4 indexers showing in our auto_generated_license_pool. Are there any impacts to recreating the auto_generated_license_pool so that we can configure 4/4 indexers as license slaves? We have done a rolling restart of the cluster peers, the SH and the CM and our license quota is still showing up over our limit because the events appear to primarily get indexed by one of the indexers. Any help is appreciated. Thanks! ... View more

I have a two different props.conf stanzas for two different log types (i.e., bluecoat and bluecoat_proxysg). What is the best way to handle props.conf? Should I just create a separate sourcetype for each? The timestamps are in different formats and locations in the events. ... View more

I am importing cisco logs that have two timestamps with different formats. Unfortunately, configuration set in props.conf for the app is still not pulling extracting the correct date. Here is a sample: <splunk system timestamp> Aug 23 12:00:00 xxxx.org: <second timestamp> 2016 Sept 28 12:34:53 EDT [test] TIME_PREFIX = org :\s* #TIME_FORMAT = %Y %b %d %H:%M:%S %Z MAX_TIMESTAMP_LOOKAHEAD = 75 ... View more

Our syslog data in Splunk is showing up with at least 1% of the results with incorrect line breaking. We have tried to update many settings in props.conf (in the master-apps directory) below: We are using a Universal Forwarder. should_linemerge = true break_only_before_date = true should_linemerge = false line_breaker = (\n+) should_linemerge = true line_breaker_lookbehind = 300 TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 15 None of our updated settings worked. Any suggestions are welcome. ... View more