Hi all,  our regex is unable to extract host from the logs, can you pleas ehelp with the correct regex.though this regex works when checked in regex101, not sure why unable to extract [hostextract] REGEX = ^.*\w+\s+\d+\s+(?:\d+:){2}\d+\s+(?P<test>\w+)\s+ SOURCE_KEY = _raw DEST_KEY = MetaData:Host FORMAT = host::$1     e.g. logs format   May 1 08:35:30 10.98.6.249 May 1 08:35:30 host_abc   Apr 10 08:45:20 10.98.6.249 Apr 10 08:45:20 host_def   May 1 08:35:30 10.98.6.249 May 1 08:35:30 host_ghi     ... View more

Hi All, I am unable to see the logs for the source even after seeing the file is being tailed and read in internal logs. Can you please guide as to what could be wrong here?   I can see in internal logs: INFO Metrics - group=per_source_thruput, series="log_source_path",  kbps=0.056, eps=0.193, kb=1.730, ev=6, avg_age=0.000, max_age=0   But I dont see the logs in Splunk, the recent logs are there in file in the host, other sources are also coming into splunk fine.       ... View more

I have logs being monitored form winodws as below:   [monitor://D:\Logs\*] sourcetype = abc index = def I also currently have info logs being null routed which applies to  all the //D:\Logs\jkl.txt and therefor we dont see any logs from //D:\Logs\jkl.txt in Splunk.   Now without modifying the nullroute in props and transforms, I want to ingest logs from //D:\Logs\jkl.txt, how can i avoid the null route to not apply on this specific logs? ... View more

Hi All,   We have widnows event and other application logs ngested into splunk.   There is no problem with windows event logs but for our application related logs, the logs stop suddenly and starts reporting again but the log file in windows is being continuously updated with recent logs though the modified time does not get updated because of the windows feature. The modified time for the log file is not an issue because the logs starts rolling in even when the modified time is same but the log file had latest logs.   we are using splunk forwarder 9.0.4 version currently. Can someone please help in triaging this issue? It is a problem with only one specific source with this windows host and other sources (windows event logs) are flowing in properly. ... View more

Hi All, I have setup the Object and event input configuration in the salesforce TA, I am able to see the object logs but unable to see the event logs in splunk cloud.   Any directions of triaging the issue? Appropriate permissions are provided for the salesforce user. ... View more

Hi team, I am following the below instructions to bring Genesys cloud logs in to splunk  https://splunkbase.splunk.com/app/6552 Under the details and intsallation instruction of the app, I cant find the configuration and it also did not prompted me for the input configuration ... View more

Hi, I have setup the Object and event input configuration in the salesforce TA, I am able to see the object logs but unable to see the event logs in splunk cloud.   Any directions of triaging the issue? Appropriate permissions are provided for the salesforce user. ... View more

Hi All, I am using a mstats for a mteric and I am evaluating my hour and minute field something like below:   | mstats rate_avg(abc*) prestats=false WHERE "index"="def" span=3m | rename rate_avg(* as *, *) as * | eval Date=strftime(_time,"%m/%d/%Y") | eval hour=strftime(_time,"%H") | eval minute=strftime(_time,"%M") | transpose column_name=instance | rename "row 1" as MessagesRead | eval MessagesRead=ROUND(MessagesRead,0) | where MessagesRead < 1 Now I am unable to to use the below filter condition | search NOT (instance="*xyz*" AND hour=09 AND (minute>=00 AND minute<=15))     as I dont want to alert for a particular instance only from 9 to 9:15, but it should alert for other instance for this time period.   Now before the transpose the instance does not exist and I cant use the filter and after transpose I am unable to filter on hour and minute.   Can u please help in filtering after transpose? ... View more