Hi, I have a logfile which looks like this: 2018-12-06 02:53:18 * [13396] PASSED: ftp file X20181206025051227_XXXTracking.csv renamed to 20181206025051227_XXXTracking.csv 2018-12-06 02:53:18 * [13396] PASSED: ftp 20181206025051227_XXXTracking.csv -> company@ftp06.XXX-group.eu:out My props.conf looks this: [spdh120] TRANSFORMS = setnull-test,spdh120 TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 30 TIME_FORMAT = %Y-%m-%d %H:%M:%S SHOULD_LINEMERGE = false TRUNCATE = 0 EXTRACT-MESSAGE = \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s\*\s\[\d{5}\]\sPASSED:\sftp\s\d{17}(?<FILE>.+)\s->\s(?<RECEIVER>.+)@ftp06.gls-group.eu:out and my transforms.conf: [spdh120] DEST_KEY = queue FORMAT = indexQueue REGEX = @ftp06.gls-group.eu:out But, I still get this error in my logfile and no data into my indexer: 12-06-2018 03:23:46.252 +0100 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (30) characters of event. Defaulting to timestamp of previous event (Thu Dec 6 03:23:17 2018). Context: source=/e/logs/spdh120_20181206.log|host=udts|spdh120 Can anyone help me and tell me what I configured wrong? There are two problems: the failure during parsing the timestamp and that I didn't get any data into Splunk from that logfile. Thx for your help ... View more

Hello, I'd like to know if it makes more sense to have only one props.conf and one transforms.conf. Or is it better to split it between different files? Is it even possible to write everything to one file? Many thanks in advance. ... View more

Hello, I have different server running the same process. I like to count the "ERROR" in the logfile and the color of the graph should change depending on the number of errors. Like 0 to 2 error = green, 3 to 10 error yellow and above 11 error red. How can I realize this in a report. My search is index="Index_name" SEARCHSTRING |stats count by host What I have to add, the the color of an host changes if the number of SEARCHSTRING is like written above. Thx for your help. ... View more

Hi, I try to log a file which is located in a subfolder of C:\Users\%USERNAME%\ and I don't know how I can do this in the inputs.conf I tried different things but nothing worked. I tried to use the windows environment variables like $USERNAME or $HOMEPATH but both aren't working. Also I tried to set a new variable with set SPLUNK_USER="C:\Users\%USERNAME%\" or setx SPLUNK_USER C:\Users\%USERNAME%\ . Nothing worked. Can someone help me or give me useful hint? Kind regards ... View more

Hi, I tried to send different geolocations with different timestamps and one driver to see a trace of the route of our driver. But it didn't work. I can't see a trace. I send following example data to the index: date;LAT;LON;DRIVER 2017-11-28 16:30:45;51.093511;9.549121;0815 2017-11-28 16:33:45;50.904731;9.444201;0815 2017-11-28 16:38:45;51.143050;9.257047;0815 2017-11-28 17:00:00;52.363053;13.502228;0815 2017-11-28 17:45:00;52.551258;13.294692;0815 2017-11-28 17:50:15;52.537081;13.263395;0815 2017-11-28 18:00:00;52.528005;13.274333;0815 2017-11-28 18:05:00;52.511196;13.301656;0815 2017-11-28 18:10:00;52.487449;13.331712;0815 2017-11-28 18:15:00;52.429807;13.524335;0815 And I thought I can see many points where the driver was. But I only see a marker on the last point. Kind regards for your help. ... View more