I am trying to write a search that will pull the 10 (or so) most recent events for each host. The tail and head commands apparently do not allow any grouping, and I am trying to wrap my head around how to do this. I know this does not work, but this is what I am looking for: index=index1 | head 10 by host The closest I can come up with is:  index=index1 | stats values(_raw) by host But that still gives me everything in the time range, not just the last 10 events per host. ... View more

We have upgraded our NIPS and the management tool has a different IP address than the old one. The NIPS is sending data to our syslog server and putting it in our unassigned folder. I edited the syslog filters to put any messages from the new IP address in the NIPS folder for monitoring. I have restarted the syslog-ng service and the Splunk service. I have confirmed the logs are being written to the NIPS folder on the syslog server now, but Splunk is still importing them to the unassigned index instead of the NIPS index and showing the source as the old folder. I have also confirmed that no new entries have been put in the old folder since the change. The inputs.conf looks like this. Where else can I look that might be causing the data to not go into the NIPS index?     [monitor:///app01/syslog/data/siem01/nips/.../*messages] _rcvbuf = 1572864 disabled = false host = siem01 host_segment = 6 index = nips sourcetype = mcafee:ips [monitor:///app01/syslog/data/siem01/unassigned/.../*messages] _rcvbuf = 1572864 disabled = false host = siem01 host_segment = 6 index = unassigned sourcetype = syslog       ... View more