I have seen somewhat similar issues on here, but none that meet my situation. I have a directory on a Windows server with multiple textual log files in it. Some of the log files on that server in that directory have a date format of MM/DD/YY mm:hh:ss. Splunk parses that just fine. Some of the log files on that same server in that same directory have a date format of MM/DD mm:hh:ss. Splunk parses that horribly!! Ends up with the wrong year. Now obviously the log file needs to be written correctly with the full date/time including the year but that's not an overnight fix. I saw one solution for a similar issue talk about putting things in the props.conf, but I thought you would need to put that in at the host level and obviously I have multiple situations in the same directory on the same host. Any help would be appreciated. ... View more

I have 2 universal forwarders sending data to 1 indexer. I want to search to see if one of the universal forwarders is actually sending data. How would I do that? ... View more

This erro?r in Splunk 6 is on the indexer. ERROR ProcessDispatchedSearch - PROCESS_SEARCH - Error opening "C:\Program Files\Splunk\var\run\splunk\dispatch\scheduler__nobody_SUxJX0ltYWdpbmdfQXBw__RMD539773f0726cc8328_at_1382734800_49\search.log": The operation completed successfully. Seems to have stopped searches and/or forwarder connectivity. Any ideas? ... View more

Has anyone come up with a solution to WMI rounding down decimal values for Windows 2003 performance monitor counters? For instance, values less than 1 are rounded down to 0. I understand that using a local forwarder would help but I can't do that for a number of reasons. Thanks!! ... View more

Is it possible to only forward certain files during a specific time period? For instance, I only want the forwarder to monitor file XYZ between 9 AM to 5 PM. I don't want to approach this from a search standpoint. I want the forwarder to basically exclude the file from 5 PM to 9 AM. Not touch it at all. Thanks!! ... View more

Regardless of one's approach with collecting data, Splunk is heavily dependent on the network. How does one deal with infrequent network latency? It will disrupt one's alerts because the dispatch earliest time will not be back far enough to catch the events that should have been alerted on. Is there a way to dynamically change the dispatch earliest time based on the network latency? Any other approaches? ... View more