Your events are already single line events, so to remove debug of the line breaker, I explicitly set break each line and was able to extract the timestamp with: Update: added landen99's line breaker suggestion below in case you absolutely have to have it and this props still working for me.... [ splunk_answers_timestamp ] SHOULD_LINEMERGE = false NO_BINARY_CHECK = true BREAK_ONLY_BEFORE = ^\[\d+\]\[\d+ TIME_FORMAT = %m/%d/%Y][%H:%M:%S.%3N TIME_PREFIX = ^\[\d+\]\[\d+\]\[ TZ = America/New_York KV_MODE = none MAX_TIMESTAMP_LOOKAHEAD=75 I think perhaps you were't accounting for what chars would be left after your line breaker and time prefix....also not sure if you escaped everything you needed to... ... View more

probably an administrative oversight? licences may have been attributed to other people in your org? Either way, follow up with your Sales rep as having those licences in your support portal can be helpful in case you need to recover them, or verify which is one is which. ... View more

Do you have access to your support portal? If you go under 'My Licences' then sort by 'Current' you should see your licence size and GUID. Mapping the GUID should allow you to sort them out. ... View more

You could make an API call to manage the store.. http://dev.splunk.com/view/webframework-features/SP-CAAAEZG or use | outputlookup my_kvstore from search results (if ur data is avail there), where my_kvstore is the name of your store, to overwrite that kvstore entry... be sure you look up the key first so you update/delete the right record! ... View more

yea u are right, thats why I didnt use the csv sourcetype. Can you post and example of the pre-amble then headers with data? ... View more

actually we did this with tabular data...I assume your data is true csv? ... View more

I believe I did a similar thing by not indexing as csv. instead index the csv as 1 event, then use multikv to extract ur columns and rex to extract the preamble... ... View more

at this point it is worth gathering your data and re-installing???? ... View more

so strange... is this a licenced deployment or are you running the free licence? ... View more

is ur system healthy? df -h your partitions still have space?? ... View more

is that ur last log? at 16:50:44 on 06-19?? ... View more

i doubt u were able to post the entire 100 lines of log... do a tail -10 please...whats ur last 10 events in the log? ... View more

can you check your splunkd.log please cd /opt/splunk/var/log/splunk/ tail -100 splunkd.log dont understand why you get nothing calling ./splunk start or stop ... View more

splunk is not running.... were you the one who installed splunk?? can you confirm that splunk is installed at /opt?? ... View more

please do ps -ef | grep splunk ... View more

dude, you need to locate your install... does /opt/splunk/bin exist? if it does do: cd /opt/splunk/bin ./splunk stop what do you get??? ... View more

Yah, sorry, the pitfalls of helping while on mobile. ... View more

configure the input to not use a custom sql query...tell splunk the table and let it build the query...does that work??? ... View more

also try not specifying a custom sql query...just use the default query with the table name when u configure the dump ... View more

what happens if you go back to db query and run it without the limit 1000??? ... View more

Theres no conflict..they are designed to run side by side... try this search... index=_internal source=*dbx.log *IDM2* You should see when the dump was executed..tells you how long it took and any results or errors ... View more

index=_internal source=*dbx* *IDM2* ... View more

my apologies...the text took out the star wildcards...there should be an asterisk on either side of dbx ... View more

dbx logs usually give a clue as to what happened in the poll of the db index=_internal source=dbx you can even throw a IDM2 in your search to filter the logs down... ... View more