It uses standard strptime format: https://docs.python.org/2/library/datetime.html#strftime-strptime-behavior. I'd put in a token that looks like: token.0.token = (\w+\s+\d+\s+\d{2}:\d{2}:\d{2}) token.0.replacementType = timestamp token.0.replacement = %b %d %H:%M:%S The number 0 is just an example, pick any free number. ... View more

https://answers.splunk.com/answers/3184/hostname-in-inputs-conf.html By default, Splunk creates $SPLUNK_HOME/etc/system/local/inputs.conf on first time run. You're overwriting that by copying $SPLUNK_HOME/etc/system/default/inputs.conf to $SPLUNK_HOME/etc/system/local/inputs.conf. Now, this should work, but it doesn't. I filed a bug, SPL-108269 to track it, but will probably be a while before anyone gets to it given pretty valid workarounds available. This will affect any modular input you're using, not just Stream. My suggestion to you is to put your configurations you want to monitor in your own app, or at a the very least, put them in $SPLUNK_HOME/etc/apps/search/local/inputs.conf and not change the default of having your hostname determined at First Time Run and written to $SPLUNK_HOME/etc/system/local/inputs.conf. ... View more

We are not likely to update this application. We're evaluating it for End of Life right now. Given the number of things we could be doing, this isn't that high of a priority given the original version didn't get that much adoption. ... View more

No, your problem is the use of dash as the default shell in Ubuntu. Run the following: debconf-set-selections <<< "dash dash/sh string false" dpkg-reconfigure -f noninteractive dash This will set your default shell to bash and the problem will likely go away. ... View more

In 6.2 we added a cap for field size to limit the risk of unbounded memory growth. This field is MaxFieldSize, but unfortunately it didn't make it the docs. http://docs.splunk.com/Documentation/StreamApp/6.2.2/DeployStreamApp/ConfigureStreamForwarder#Configure_streamfwd.xml That docs page covers how to configure streamfwd.xml, and if you add a MaxFieldSize parameter you can up the limit to something larger if you're concerned about RAM growth or if not you can set the value to 0 for unlimited. ... View more

あなたが見ればhttp://docs.splunk.com/Documentation/StreamApp/latest/DeployStreamApp/ConfigureStreamForwarder#Configure_streamfwd.xml,そのポートのstreamfwd.xmlオプションを見ることができます。 0に、それは管理インターフェイスを無効にすることを設定します。私はGoogle翻訳を介してこれを実行するため、言葉の問題はご容赦ました。 ... View more

Yes. Sorry you had to find this, but yes it is broken. It will be fixed hopefully in the next minor version (6.2). ... View more