The LINE_BREAKER attribute requires at least one capture group and the text that matches the first capture group will be discarded and replaced with a event break.  Knowing this and that an empty capture group is allowed, try these settings:   [<sourcetype_name>] CHARSET=AUTO LINE_BREAKER = "platform":"ArcodaSAT"\}() SHOULD_LINEMERGE = false     ... View more

Ubuntu on Windows is still Windows.  I had the same problem.  You have to use a real Linux box. ... View more

I'm guessing you're packaging the app on a Windows machine.  That will never work because Windows can't/won't set the file permissions correctly.  When I used to package on Windows, I would transfer the .tgz file to a Linux system, explode it, change the permissions, then re-tar it and transfer back to the Windows machine for uploading. ... View more

There are several ways to send data to HEC and not all of them use that format.  The raw endpoint should accept events in your desired format.  See https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/FormateventsforHTTPEventCollector#Format_events_for_HTTP_Event_Collector ... View more

URLs with spaces in them must be encoded.  Use the urlencode command available with the Webtools Add-on (https://splunkbase.splunk.com/app/4146). ... View more

The search command doesn't handle field names on both sides of the equals sign.  Use where, instead. index =meta_info sourcetype=meta:info| search group_name=admingr AND spIndex_name=admin_audit | eval getIndex=spIndex_name | where index=getIndex   ... View more

The strptime function converts a timestamp from text format into integer (epoch) format.  To convert from one text format into another, use a combination of strptime and strftime (which converts epochs into text). | eval latest_time = strftime(strptime(latest_time, "%Y-%m-%dT%H:%M:%S.%3N%Z"), "%Y-%m-%d %H:%M:%S.%3N%Z")  Or you could use SED to replace the "T" with a space. | rex mode=sed field=latest_time "s/(\d)T(\d)/\1 \2/" ... View more

Warm and cold buckets can be copied safely while Splunk is running. ... View more

You can filter the API response using the parameters described at https://docs.splunk.com/Documentation/Splunk/9.2.1/RESTREF/RESTprolog#Pagination_and_filtering_parameters Try something like this: https://*****:8089/servicesNS/-/-/admin/macros?output_mode=json&f=title&f=description ... View more

Why emulate ARM when Splunk doesn't support it? ... View more

Splunk Enterprise is not available for ARM processors.  FWIW, I run the standard Linux version of Splunk on my M2 Mac. ... View more

What search are you using to try to find the data? ... View more

You are correct. ... View more

The "no file found" message is excluded in the base search. index=mulesoft environment=* applicationName IN ("processor","api") message!="No files found for*" ... View more

I don't understand what is meant by "mvfind is not for interfacename".  The mvfind function can be used with any multi-value field (InterfaceName is multi-valued since it is created by the values function). The mvfind function can be used with multiple values in a regular expression.   | where isnotnull(mvfind(InterfaceName("ABC|ABCD|COP"))   ... View more

A Google search for "destructive configuration resync" finds this in Docs: https://docs.splunk.com/Documentation/Splunk/9.2.1/DistSearch/HowconfrepoworksinSHC#Why_a_recovering_member_might_need_to_resync_manually ... View more

The where command does not handle wildcards.  Instead, use the search command. The values function produces multi-value fields, which require special handling. Try  this query. index=mulesoft environment=* applicationName IN ("processor","api") message!="No files found for*" | stats values(content.InterfaceName) as InterfaceName values(content.Error) as error values(message) as message values(priority) as priority min(timestamp) AS Logon_Time, max(timestamp) AS Logoff_Time BY applicationName,correlationId | where isnotnull(mvfind(InterfaceName, "Test")) | table Status InterfaceName applicationName Timestamp "Total Elapsed Time" FileList "SuccessFile/FailureFile" Response correlationId   ... View more

Please show exactly what you tried and tell how the results were not what was expected. ... View more

Either regex should work.  BTW, it's not necessary to escape the colons. Any change to props.conf only affects new data.  Config changes made in the UI take effect immediately; changes made to .conf files take effect after a restart. ... View more

The OS requirement is somewhat flexible to allow for OS upgrades, patches, etc.  In my mind, it means Linux vs Windows more than Ubuntu vs CentOS.  That said, every effort should be made to have the CM and indexers on the same release. You should have no problems adding the Ubuntu indexers to the cluster. ... View more

Clicking on the triangle should display explanatory text.  Share that text here if you need help understanding it. ... View more