In our case we have some CRON scripts and subsequently Ansible playbooks to do this but essentialy it is just doing +X on the permission or FACLS of the script files.  ... View more

My intent is that any event message without the string NO_CLIENT_SITE anywhere in it is discarded.  ... View more

@tscroggins  thanks for the steer. I'm close ot getting this working but when I implemenet the transform it drops my event. The even tline looks as follows SOMEDATA NO_CLIENT_SITE: MYSYSTEM 10.15.37.48 My props.conf is as follows: [netlogon] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Custom pulldown_type = 1 TRANSFORMS-netlogon_send_to_nullqueue = netlogon_send_to_nullqueue My transforms.conf  [netlogon_send_to_nullqueue] REGEX = ^(?!NO_CLIENT_SITE). DEST_KEY = queue FORMAT = nullQueue Is it the regEx at fault here? I have been playing with it at regex101: build, test, and debug regex but I cannot see the issue. ... View more

So I spun up a new Splunk instance in Podman (completely clean) and ingested the same file and the behaviourt is the same with no line breaking! This is with UTF8 encoding and CRLF or LF endings. So I went into the UI and created a sourcetype for it:   [netlogon] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Custom pulldown_type = 1   Now working on 9.2.0.1 but not on 9.1.2 😞 ... View more

Is there any tooling (btool perhaps) that would tell me what props/transfroms are being applied to my sourcetype? Even if I drop the sourcetype form my inputs.conf the issue perists  ... View more

I dont have one as I didn't think I needed one for something this simple. I have tried just now though adding this to no avail   [my_sourcetype] SHOULD_LINEMERGE = FALSE LINE_BREAKER = ([\r\n]+)   ... View more

OK got it so basically: UF gathers a lines and send to heavy forwarder/indexer Indexer drops all lines except those not matched by the reg ex. I'll give it a whirl! Thanks @PickleRick  and @tscroggins  ... View more

I mean structured in terms of each line in the log following a defined structure (space delimited fields) that lends itself to easy parsing. ... View more

I assumed (rather embarrassingly!) this restarted the deployment server splunkd! This is very useful.  ... View more

So basically we can do the following: Create a dummy app and assign system/UFs we wish to restart Flag that app to restart with the checkbox Restart depoyment server Dummy app gets pushed to UF UF reads it and restarts/reloads itself? ... View more

Thanks for taking the time to reply @ITWhisperer . Much appreciated. That makes perfect sense.  ... View more

Greta answer and thanks for taking the time.  ... View more

Ingest ~ 15 GB per day. We have One search head (32 cores and 64 GB RAM) [Physical] One cluster master (4 Cores and 32 GB RAM) [VM] 2 indexers (32 Cores and 64 GB  RAM) [Physical] All Windows Server 2019 and basic metrics of CPU Usage, CPU queue, memory/Swapping and Disk latency and negligible. It seems to have started when we recently upgrade from 8 to 9 and gotten worse. The monitoring console shows no issues.  ... View more

I have the same issue. The actual PNG file I have located on my search head (Splunk Enterprise 9 on windows 2019)  at  c:\Program Files\Splunk\etc\system\static\mod_alert_icon_email.png c:\Program Files\Splunk\share\splunk\search_mrsparkle\exposed\img\mod_alert_icon_email.png And referenced in the following config files etc\system\default\alert_actions.conf   Contents of this file are [email] icon_path = mod_alert_icon_email.png label = Send email description = Send an email notification to specified recipients       ... View more

I think I have explained it poorly.  I guess when I think about it what I wish to achieve is a s follows: Problem: I have multiple search apps that have various views, navigations, macros etc. I source control the apps in Git and when I wish to create a new version of the app I do so by updating Git and deploying the folder/files from that Git repository to my search head. This works well. Each app shows in the UI as a separate entity under the Apps dropdown  I have been re-evaluating these apps as most of them are used by the same team. They have asked me if I could combine them into one app (all dashboards, views and navigation etc.)  so they only have to navigate one app the in the Apps dropdown. I wish though to maintain my deployment model within GIT so combining them all into one single app/folder is a challenge in this regard. So, now that I think of it is the following possible? Keep all apps separate so I keep my deployment model Remove the navigation items from these apps Create a new app that only has the navigation/views from the other apps?     ... View more

Thanks @jotne and your point is well noted. I was using a simple example but I have used ^ and $ for start/end markers for my production regex.  ... View more

@ITWhisperer I can't believe I missed that! Wood for the trees and been at a computer screen too long. Should have re-read the docs. Thanks for taking the time to answer. Much appreciated! ... View more