Hi, i'm currently working on a props.conf and have different values from _time and the timestamp in my logs. What did i wrong? Thanks in advance. 2023-01-24T13:00:23+00:00 avx.local0.notice {"host":"xx-xx-xxxxx-xxxx-xxxxx-x-xx-000x-xxxxx-xxxx-xx.xxx.xxx.xxx","ident":"syslog","message":"xx:xx.xxxxxx+xx:xx xx-xx-xxxxxx-xxxx-xxxxxxx-x-xx-xxxx-xxxxx-hagw-xx.xxxx.xxx.xxxx From Splunk search the values are the following: timestamp: 2023-01-24T13:00:19.141113233, _time: 2023-01-24T14:00:23.000+01:00 My props.conf is the following: [s3:Test] TIME_FORMAT = %Y-%m-%dT%H:%M:%S%z TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 26 TRUNCATE = 10000 SHOULD_LINEMERGE = false ... View more

Hello everyone, currently our Indexers keep crashing randomly.  We're only running Linux OS, within Splunk 9.0.2. Any suggestions what the Crashing thread means and how to solve that? Thank you. Received fatal signal 6 (Aborted) on PID 235655. Cause: Signal sent by PID 235655 running under UID 1018. Crashing thread: FwdDataReceiverThread Registers: RIP: [0x00007F4A05C3E387] gsignal + 55 (libc.so.6 + 0x36387) RDI: [0x0000000000039887] RSI: [0x00000000000399C9] RBP: [0x000000000000008F] RSP: [0x00007F49E4FFE238] RAX: [0x0000000000000000] RBX: [0x000055B8710F5CA8] RCX: [0xFFFFFFFFFFFFFFFF] RDX: [0x0000000000000006] R8: [0x00007F49E4FFF700] R9: [0x00007F4A05C552CD] R10: [0x0000000000000008] R11: [0x0000000000000206] R12: [0x000055B870FE5A93] R13: [0x000055B8710F5D88] R14: [0x000055B872226488] R15: [0x00007F49E4FFE4E0] EFL: [0x0000000000000206] TRAPNO: [0x0000000000000000] ERR: [0x0000000000000000] CSGSFS: [0x0000000000000033] OLDMASK: [0x0000000000000000] OS: Linux Arch: x86-64 Backtrace (PIC build): [0x00007F4A05C3E387] gsignal + 55 (libc.so.6 + 0x36387) [0x00007F4A05C3FA78] abort + 328 (libc.so.6 + 0x37A78) [0x000055B86E1D4D26] ? (splunkd + 0x1A08D26) [0x000055B86EE39BD2] _ZN26HealthDistIngestionLatency29calculateAndUpdateHealthColorEv + 914 (splunkd + 0x266DBD2) [0x000055B86E744627] _ZN22TcpInPipelineProcessor7processER15CowPipelineData + 199 (splunkd + 0x1F78627) [0x000055B86E74CD57] _ZN14FwdDataChannel16s2sDataAvailableER15CowPipelineDataRK15S2SPerEventInfom + 167 (splunkd + 0x1F80D57) [0x000055B86F2B2255] _ZN11S2SReceiver11finishEventEv + 261 (splunkd + 0x2AE6255) [0x000055B86F059E48] _ZN18StreamingS2SParser5parseEPKcS1_ + 6520 (splunkd + 0x288DE48) [0x000055B86E73E004] _ZN16CookedTcpChannel7consumeER18TcpAsyncDataBuffer + 244 (splunkd + 0x1F72004) [0x000055B86E74055D] _ZN16CookedTcpChannel13dataAvailableER18TcpAsyncDataBuffer + 45 (splunkd + 0x1F7455D) [0x000055B86F592D03] _ZN10TcpChannel11when_eventsE18PollableDescriptor + 531 (splunkd + 0x2DC6D03) [0x000055B86F4D5BCC] _ZN8PolledFd8do_eventEv + 124 (splunkd + 0x2D09BCC) [0x000055B86F4D6B39] _ZN9EventLoop3runEv + 617 (splunkd + 0x2D0AB39) [0x000055B86F58D68C] _ZN19Base_TcpChannelLoop7_do_runEv + 28 (splunkd + 0x2DC168C) [0x000055B86F58D78E] _ZN25SubordinateTcpChannelLoop3runEv + 222 (splunkd + 0x2DC178E) [0x000055B86F59A16D] _ZN6Thread37_callMainAndDiscardTerminateExceptionEv + 13 (splunkd + 0x2DCE16D) [0x000055B86F59B062] _ZN6Thread8callMainEPv + 178 (splunkd + 0x2DCF062) ... View more

Hi everyone, i got two URLs which i want to represent in one regex group. The dest Port (443) will be in a seperate group Here are two examples. my.url.is.here:443 http://myurl.de/tasks/search/home?   When i use the following regex "(?<url>[^\s:]+):?" the first example is fine, but the second only catches "http" because it only matches till the ":" Can someone help and fix my regex? Thanks. ... View more

Hi community, i have the following tstats output "| tstats count WHERE fromzone="*INTRANET*" index=*_*_* by index source getport" The getport field is for different indexes always 5 digits long for e.g. (index A has Port 22001, index B has 25003, index C has 35002) Now i want to filter out all field values from the field getport without the "1" at the end. Thanks for your help! ... View more