Really any search interface will have that ability to search across all your data. You are limited by which role you are logged into and the roles access to data. The search and reporting app is just the default app Splunk ships with. ... View more

You can use the delete command. https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Delete If you can write a search that limits the data to one copy, then you can pipe it to the delete command so you won't see both. This will only stop you from seeing it, it will not get rid of the data off the indexer. You can also clean indexes if one of the copies of data is in a different index than the other you can wipe one of the indexes of all the data in there. http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/RemovedatafromSplunk#Remove_data_from_one_or_all_indexes ... View more

The Cisco ASA TA does something similar to what your trying. If you look at the props.conf and transforms.conf that comes with that add-on it will help. What that app does is takes that one source and assigns it sourcetypes based on regex. So you can split up one source into different sections with regex and give those sections sourcetypes. Something like this: inputs.conf: [WinEventLog://MyCustomSource] disabled = 0 start_from = oldest sourcetype=WinEventLog props.conf: [WinEventLog] TRANSFORMS-force_sourcetype_for_windows = wellKnowEvents, GenericEvents transforms.conf: [wellKnownEvents] DEST_KEY - MetaData:Sourcetype REGEX = < your regex that matches these events > FORMAT = sourcetype:: < name of sourcetype> [GenericEvents] DEST_KEY - MetaData:Sourcetype REGEX = < your regex that matches these events > FORMAT = sourcetype:: < name of sourcetype> ... View more

You can certainly set up a forwarder to do this. You would install that forwarder where it can access those various directories you want to monitor, then take the inputs from the inputs.conf on your Splunk instance and put them on that forwarder. If you aren't forwarding the data to your standalone Splunk instances there is probably an inputs.conf on the indexer bringing in the data. Regardless of where the inputs.conf is you will need the stanzas in that conf file that monitors the directories you want. You want those on the forwarder inputs.conf You can then get the forwarder to send data to Splunk Cloud. You will need to download the Splunk Cloud forwarder credentials app and install it on the forwarder. Here is the directions https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/User/ForwardDataToSplunkCloudFromWindows ... View more

Where are you migrating from? Is this from on a prem installation to Splunk cloud? Are you using a forwarder? I am trying to figure out what inputs you are mentioning and where they are located. ... View more

When you go to the link you posted you don't see a page to select what operating system you have and then some blue download now buttons? ... View more

If you click on the download now link it will take you to the "thanks for downloading" page and start the download. You can cancel the download and get the wget link which will be on that "thanks for downloading" page. ... View more

Are you looking at the inputs.conf in the default directory? Take a look at the inputs.conf in the /splunk/etc/apps/splunk_app_db_connect/local directory. ... View more

That is what I meant. The extra events you sent me had PSAPPSRV.XXX in the beginning that was matching and messing it up. ... View more

I see the problem there is a period followed by three digits earlier on those events... Here is a regex that matches the whole timestamp try this out. \[\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}\s(?<userid>.*)\@JavaClient\s ... View more

Also can you show me exactly the rex command that you are using? ... View more

Can you post some samples of events that didn't get it correctly pulled? That way I can put those into my regex tester and tweak the regex. ... View more

The @ symbol is not a reserved character for regex so you shouldn't need to escape it. ... View more

Are some events correctly pulling the user id out? Is it just some events that pull the numbers before? ... View more

Your regex seems to have changed. The one you posted originally seems like it should work. Use this regex \.\d\d\d\s(?<userid>.*)\@JavaClient\s instead of .\d\d\d\s(?<userid>.*)\@JavaClient\s ... View more

Your regex is correct in matching XBATCH and ABCSRV however for Splunk's rex command you will need to give your extraction a name. That is what the <? ... > in the capture group is for. Try doing this \.\d\d\d\s(?<USERID>.*)\@JavaClient\s As for regex syntax here is a cheat sheet I regularly reference when writing regex. https://www.cheatography.com/davechild/cheat-sheets/regular-expressions/ ... View more

I was afraid you would ask that :P. I will try to get one working in my spare time. I will let you know! ... View more

If you have installed the splunkclouduf.spl that app has an outputs.conf that will point the forwarder to Splunk Cloud. So any inputs you have configured on your forwarder will send to what is configured in that outputs.conf regardless of what app the conf files are located. So you have the inputs.conf which is trying to listen on port 443 for tcp traffic. The outputs.conf will send that data to Splunk Cloud. If you aren't seeing that data in Splunk Cloud, make sure you have made the index that it expects "incapsula". As well as making sure there are not any firewall rules blocking the port your trying to listen on. Is this the first time you are forwarding data to Splunk Cloud from this forwarder? ... View more

The inputs.conf will specify what data to collect. The outputs.conf on the forwarder will specify where to send the data. To tell the forwarder to send data to Splunk Cloud you will need to download an spl file called splunkclouduf.spl which is a packaged app. You need to install this on the forwarder, this has the configured outputs.conf that will connect the forwarder to your Splunk cloud instance. Here is our documentation on how to download the splunkclouduf.spl and install it on your forwarder. https://docs.splunk.com/Documentation/SplunkCloud/latest/User/ForwardDataToSplunkCloudFromWindows#Step_3:_Download_and_install_the_universal_forwarder_credentials ... View more

Here is someone who did exactly what you're asking. https://answers.splunk.com/answers/321502/show-placeholder-textpanel-for-a-hidden-panel-on-a.html ... View more