Hi @dwaddle , May I know where do we need to run this? Can you please share some sample output? ... View more

Tested in splunk , only when I add (?ms) in front of regex it matches. But when I check this entire regex in the regex tool it does not match (?ms)^#Date.+\n#Fields.+ and I am not sure if we add (?ms) in transforms will work or not?     ... View more

sure will give a try and what does (?ms) do? ... View more

Yes I have checked in regex looks good. There are no other HF's before.   ... View more

I tried the props settings you suggested but still same issue.   ######   BEGIN STATUS   ##### is coming as a separate event. #LAST UPDATE : Wed, 29 Nov 2023 10:39:57 +0000 GlobalStatus.status=OK  , this is also coming as a separate event  Both these events should come under one event.   ... View more

My script name was access-abc.sh ,  I just removed hyphen and renamed it to accessabc.sh and that fixed the issue and able to see the Data in Splunk. But now I have issue with event Formatting, Actual website data I am ingesting is shown below: ##### BEGIN STATUS ##### #LAST UPDATE  :  Tue,  28  Nov  2023  11:00:16  +0000 Abcstatus.status=ok Abcstatus.lastupdate=17xxxxxxxx555     ###  ServiceStatus  ### xxxxx xxxxxx xxxx ###  SystemStatus  ### XXXX' XXXX   ###  xyxStatus  ### XXX XXX XXX . . . . So on....   But in splunk below lines are coming as a seperate events instead of being part of one complete event: ##### FIRST STATUS #####  - is coming as seperate event Abcstatus.status=ok  - this is also coming as a separate event   Below all events coming as one event which is correct and the above two lines should also be part of this one event: Abcstatus.lastupdate=17xxxxxxxx555 ###  ServiceStatus  ### xxxxx xxxxxx xxxx ###  SystemStatus  ### . . . So on.... #####   END STATUS  #####   Below is my props: DATETIME_CONFIG = CURRENT SHOULD_LINEMERGE=TRUE BREAK_ONLY_AFTER = ^#{5}\s{6}END\sSTATUS\s{6}\#{5} MUST_NOT_BREAK_AFTER=\#{5}\s{5}BEGIN\sSTATUS\s{5}\#{5} TIME_PREFIX=^#\w+\s\w+\w+\s:\s MAX_TIMESTAMP_LOOKAHEAD=200   Can you please help me with the issue?     ... View more

Hi @richgalloway  I have changed the stanza to script from monitor but still unable to see any data in splunk? Is there anything else I have to check? ... View more

I did not understand the difference between the two stanzas can you please explain  ... View more

How to run the script from database? ... View more

In the first condition how can splunk check months old logs  I didn't understand the second condition can you please explain clearly what does limits have to do with reading old logs? ... View more

In the first condition how can splunk check months old logs  I didn't understand the second condition can you please explain clearly what does limits have to do with reading old logs?     ... View more

Check if that index is associated to any splunk role if yes check if you have access to that role then you can see that index while you search may be  One more to check is there any data sent to that index         ... View more

In the internal logs it gives error " parsing configuration stanza" ... View more

@isoutamo I have tried the configs but still same issue   Please find the props        ... View more

Thanks for the Response @isoutamo  The first number in the timestamp 1/09/2022, 2/09/2022 is day and the second number is month shall I use DATETIME_CONFIG as NONE or CURRENT? and DATETIME_CONFIG=NONE Does exactly what, if you can explain this that would be great! 🙂   ... View more

Is the issue fixed? ... View more

Me too looking for the same ... View more