Hello! I'm trying to change the timestamp (_time) from Perfmon:CPU before index, to use my Splunk Heavy Forwarder date instead of the original event timestamp. The Perfmon:CPU _raw is: 05/07/2020 15:46:37.269 -0300 collection=CPU object=Processor counter="% Processor Time" instance=_Total Value=1.887035386881708 My Splunk architecture is: Universal Forwarder -> Heavy Forwarder -> Indexer I have tried the following configurations on my Heavy Forwarder (props.conf): [source::Perfmon...] DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 1 [Perfmon:CPU] DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 1 [source::Perfmon:CPU] DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 1 None of this configurations worked and the _time of Perfmon:CPU events already is the original timestamp (first line of _raw). I also configured a transform to remove the first line of _raw event. Even if the first line is removed, the _time field don't respect DATETIME_CONFIG = CURRENT configuration. Can anyone help me? ... View more

I'm facing something strange about _time and timezone. We have 2 hosts indexing the same event type (Unix:Uptime). On the search head, I have the following situation: 1 - The first host shows the correct timestamp 2 - The second host shows the timestamp 1 hour ago The events have the same timezone and the same "date_hour" field. What I'm doing wrong? ... View more

Hello, I need to monitor some Oracle Database agent logs with Splunk Universal Forwarder. The base directory for finding the logs is $ORACLE_HOME. We´re using this configuration to monitor these logs in a Splunk Enterprise environment: [monitor://$ORACLE_HOME/log/*/agent/ohasd/oraagent_(grid|oracle)/oraagent_(grid|oracle).log] ... I know we could configure ORACLE_HOME env in splunk-launch.conf on each UF instance. However, we have already installed all Universal Forwarders and we don´t know the $ORACLE_HOME env variable on the UF hosts. we have about 300 hosts, so we decided to do the above configuration to save time: [monitor:///.../log/*/agent/ohasd/oraagent_(grid|oracle)/oraagent_(grid|oracle).log] When I execute splunk list monitor its listing all directories under / partition, even if there is one log file per host. My questions are: 1 - Does Splunk will really look into all directories under /? 2 - If yes, would I have performance problems because the huge amount of directories? Thanks. ... View more