Hello, I need to take events with two kind of text (different paths) : Appended to:  G:\Streamserve\ Appended to:  D:\G_volume\Streamserve\ As you can see the is part in the middle that should be different (I have only those 2 kind of cases). I tried with \S* as non whitespace characters but it's not working.   sth like this Appended to: \w?:\\(G_volume)*\\*Streamserve What's is the easiest way to do it?  Thanks fo the help ... View more

Is there a way to reduce memory usage for splunk Forwarder? I have two directories with 57k files each (120Mb each) and After restarting service I checked Task manager and memory usage reach 2Gb. I can't reduce the number of files because I've already done that and can't reduce more. I'm sure that the issue is with those directories because after I delete them from inputs.conf memory reach only 100Mb.  ... View more

I have a folder with logs, every hour one logfile is written to it.  I also have an alert that is triggered when no file is written in the last hour (checking 15 minutes post a hour) Query: index=xyz sourcetype=abc | eval since = now() - _time | search since < 3600 Mostly it works but sometimes it's triggered even if I can see in the history that logfile for that hour is present in splunk with acurate _time and nothing is missing What could be the problem? ... View more