Hello Guys, I am facing issue with the _time field. Splunk is not recognizing the time properly, but all other things are working perfectly like _indextime and all. I am attaching the screenshot for references. I had even included following things in props.conf file on both the paths etc\system\local & etc\apps\TA_cisco_ios\local , but after doing that, still no luck [cisco:acs] # TIME_PREFIX = ^ # TIME_FORMAT = %B %d %H:%M:%S # MAX_TIMESTAMP_LOOKAHEAD = 19 # SHOULD_LINEMERGE = false # LINE_BREAKER = ([\r\n]+)(\w{3}\s+\d+\s+\d{2}:\d{2}:\d{2}\s) # TRUNCATE = 999999 Any solutions to sort this out? ... View more

Hello Guys, I am going to do a PoC with some use-cases of NetApp and Exchange. The thing I want to achieve is to deploy both apps on the same OS platform, but the problem I am facing is both apps require different OS platforms of Splunk Enterprise. The Netapp deployment guide says, Splunk app for NetApp Data ONTAP can be deployed on the Linux platform of Splunk Enterprise. FYI : http://docs.splunk.com/Documentation/NetApp/2.1.0/DeployNetapp/Platformandhardwarerequirements The Exchange deployment guide says, Splunk app for Excahnge can be deployed on the Windows Platform of Splunk Enterprise. FYI : http://docs.splunk.com/Documentation/MSExchange/3.1.3/DeployMSX/Platformandhardwarerequirements I am fearing that the client will not allow us to have two Search heads. How can we achieve this? Is there any possible way to get NetApp logs to a Windows Environment of Splunk Enterprise? Guys please help me out to figure of some solution. Thanks in Advance. ... View more