The .* does not match newline etc, so here is a trick I did find.  Change .* with [\s\S]* example: \<ReportItem\s(?<pluginout>[\s\S]*?)\<\/ReportItem\>   ... View more

Make sure all you path are correct.   Has this worked before? You should also set the hot volume  to not be able to take all the disk volume. Eks if you have 2TB of Hot/Warm disk, use some like this: [volume:hot] path = /data/splunk/index/hot/vol maxVolumeDataSizeMB = 1900000 ... View more

It would help if you post the data as text instead of a photo of it. ... View more

I did install adguard (DNS blocker) and sees that beam.scs.splunk.com is one of the default blocked sites. ... View more

As richgalloway write.  There should be one License Manager and all servers that need License should talk to that server on port 8089 (can be changed).  Servers running full splunk like Search Head, Heavy forwarders, Indexes, HEC etc needs to be able to talk to LM Server. ... View more

Only admin should be allowed and able to remove indexes.  You should have controll of who that is. ... View more

This still has not been solved in 2024.  I do mess a Heavy Forwarder group/tag as well.  Indexer group should only contain indexers, but we now have the HF in that group as well. ... View more

Here are the setting for props.conf   SHOULD_LINEMERGE=false #Should always be false LINE_BREAKER=([\r\n]+)IP #Adds IP to the line breaking (If all lines starts with IP) NO_BINARY_CHECK=true TIME_FORMAT=%e-%m-%y %T #Sets the time format TIME_PREFIX=At: #Use time found after the At: MAX_TIMESTAMP_LOOKAHEAD=20 #Do not search more tha needed for the time   ... View more

Why not just: REGEX = authentication\sfailure ... View more

I did try to find in documentation that summaryindex is an alias for collect, but it's not documented as far as I can see.  But if you start typing | summaryin , splunk will show info for collect command.  So yes its the same command. ... View more

You should accept ptrsnks answer not your reply. ... View more

Post the output of: | inputlookup testip If its to long post part with IP 10.10.10.x ... View more

I guess the first 9 days in every month has just one digit.  This should do:   ,\s(\d\d\.\d\d\.\d\d\s\w+\s+\d+\w+\d\d)\s   Added a + behind a space since it may be more than one space TIME_FORMAT = %z, %T %a %e%b%y Change a %d to %e ... View more

You could do that with a search command like this: | search NOT "aggregation" Or | search id=* ... View more

Here you go: (?<name>\S+)\s+(?<id>\d+)\s+(?<speed>[^\/]+)\/(?<duplex>[^\/]+)\/(?<state>\S+)\s+(?<mac>\S+) https://regex101.com/r/99K6Do/1 ... View more

You should look at the _internal index size before changing it   | dbinspect index=_internal | stats sum(sizeOnDiskMB)    In our setup with 30 days of internal index, size of file is 680GB.  So double the time, double this file. As you see above, I posted a dashboard uses _telemetry index instead to see index uses.  Our telemetry index is 215 MB of size.  We have change  _telemetry to 20 years, since it does not take up much space:   [_telemetry] # This is 20 years to get longer historical license useage. frozenTimePeriodInSecs = 788400000     ... View more

Try this Dashboard we do use.   Change this (2 places) host="your-license server"   to name of your license server.  If you have only one server or run the code on the license server, just remove the host="your-license server"  complete.  It will show on line red line that is your license limit and one bar graf that shows GB license use pr day.  To get MB, just remove one /1024 <form version="1.1" theme="dark"> <label>Used License</label> <fieldset submitButton="false"> <input type="time"> <label></label> <default> <earliest>-3mon</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <chart> <search> <query> index=_telemetry host="your-license server" source=*license_usage_summary.log* type="RolloverSummary" | eval _time=_time - 86400 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [ search index=_telemetry host="your-license server" source=*license_usage_summary.log* type="RolloverSummary" | eval _time=_time - 86400 | bin _time span=1d | dedup _time stack | stats sum(stacksz) AS "Limit" by _time] | fields - _timediff | foreach "*" [ eval &lt;&lt;FIELD&gt;&gt;=round('&lt;&lt;FIELD&gt;&gt;'/1024/1024/1024, 3)]</query> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.chart">column</option> <option name="charting.chart.overlayFields">"Limit"</option> <option name="charting.drilldown">all</option> <option name="charting.fieldDashStyles">{"Limit":"shortDash"}</option> <option name="charting.seriesColors">[0x006D9C,0xFF0000]</option> <option name="charting.lineWidth">4</option> <option name="height">800</option> </chart> </panel> </row> </form>   ... View more

For a more robust solution have a look at the TrackMe app. Its free if you are not a big user of it.  Can be som work to set it up. https://splunkbase.splunk.com/app/4621 ... View more

At the same time ask PFSense to port its firewall to Ubuntu or other Linux distro. ... View more

As PickleRick write, why not use the 500MB/day Free license? 5GB/30 = 166MB/day, much less then 500MB Free. The Free license do have some limitation that may give problem. Another solution is to point all the small Splunk setup to the same license.  Then they will all use of the same 5GB license.   ... View more

You regex:   REGEX = "Teams\.exe<\/Data>"   does not hit your input data due to the quote. Do not quote your regex in transforms.conf   REGEX = Teams\.exe<\/Data>   ... View more

You should use the timestamp after the host name like this:   TIME_PREFIX = [^,]+, MAX_TIMESTAMP_LOOKAHEAD = 30 TIME_FORMAT = %Y/%m/%d %H:%M:%S   This will pick this part, in bold: Nov 25 15:00:37 192.168.96.13 Nov 25 15:00:37 PA-Primary.abc.abc.com 1,2014/11/25 15:00:36,0011C100738,TRAFFIC.....   ... View more

Take care.  Example above fails for key name like "my-key"  since \w does not include - Also it fails for last KV, since you expect a \s and end of line, so \s? would be better. ([a-zA-Z0-9-_]+)=(?:\'?)([^\']+)(?:\'?)\s?   ... View more