Dear all, I have a syslog-ng relay server collecting syslog messages from remote network devices and saving them as log files. Then I have Splunk UF forwarding this data to the splunk cloud. Following is a sample message     May 30 04:23:54 192.168.1.132 <82>May 30 04:23:54 syslog-data-generator-01 This is a test message from b001-491 2021-05-30T04:23:54.116Z     And following is my inputs.conf     [monitor:///var/log/remotelogs/] disabled = 0 sourcetype = syslog     I can see the messages collected from splunk cloud by querying _raw My question: How would I write a query to display [data, host, facility, severity, message]   Many thanks in advance ... View more

Dear all, I am trying to initiate a search using Splunk cloud rest API. Using following code         const accessToken = "--my-super-secret-token--"; const url = "https://company-installation.splunkcloud.com:8089/services/search/jobs"; try { const authHeaderValue = `Splunk ${accessToken}`; const config = { headers: { 'Authorization': authHeaderValue }, params: { 'output_mode': 'json', 'search':'search *' } }; const res = await axios.post(url, config); return { statusCode: 200, body: JSON.stringify(res.data), }; } catch (e) { return { statusCode: 400, body: JSON.stringify(e), }; }           When the code is executed I get a 401 at line const res = await axios.post(url, config); My api token is valid and my IP address is whitelisted When axios.post is replaced with axios.get, I get list of searches back which also verifies token and IP address are good Could anyone spot why the code is failing to create a search with HTTP POST please? I am very new to Splunk REST API and any help is much appreciated       ... View more

Hi all, If I manage two separate Splunk cloud accounts and have an UF agent configured to talk to the first, how can I reconfigure it to talks second please? Second part of the question, Is it possible for a single agent to send data to both accounts at the same time without having to install a second agent? Thank you verymuch in advance for your help      ... View more