Hi, I was trying to achieve that particular sourcetype logs should reach to target 1 and not to target 2.   Even i tried to send particular logs event to target 1 and rest of the event should be discard but it is not working at all.   Below configuration is on heavy forwarder. inputs.conf [tcp://1514] sourcetype = syslog connection_host = dns _TCP_ROUTING=target1-----------When transforms.conf was not working then i define the tcp routing in inputs.conf then it stopped sending the logs to target2 but filtering of the event is not working. In tranforms.conf  [vmwarelogs] REGEX=(logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called) DEST_KEY=_TCP_ROUTING FORMAT=target1 [discarlogs] REGEX = . DEST_KEY = queue FORMAT = nullQueue   In props.conf   [vmw-syslog] Tranforms-routing=vmwarelogs,discarlogs       Outputs.conf    target1  target2---- defualt group     1. Issue number 1 : when i have defined the target group in tranforms.conf to send the logs to target 1 and not to target 2 but still it target 2 was getting the llogs    Then i have define in inputs.conf itselft then i achived the first objective just to forward the logs to target1 but in this case inputs.conf will take the precedence and transforms.conf filter is not working. _TCP_ROUTING=target1-----------When transforms.conf was not working then i define the tcp routing in inputs.conf then it stopped sending the logs to target2 but filtering of the event is not working.   Issue 2: I wanted to send the specific logs to target1 and rest of the event need to be discard and if calling the nullquue configuraiton in props.conf then it is not sending the logs at all.     Please help me out how i can achive my objective.   Is that possible to whitelist attribute in input.conf itself ???  ... View more

Hi, How we can extract time from the log event and then index ? As Splunk shows different time stamp on indexer but time stamp in log event are different.   Please help.         ... View more

Can someone please help here ? I do not want to send the logs to Indexers and i have called only vesxi in my transforms.conf as target server but still Splunk heavyforwarder is sending the logs Indexer(10.1.1.1:9996 and 10.1.1.2:9997) outputs.conf [tcpout:Indexers] server = 10.1.1.1:9996,10.1.1.2:9997 [tcpout:vesxi] server = 10.20.20.20:519 sendCookedData = false disabled = false Transforms.conf [vmwaresxilogs] REGEX = (logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called) DEST_KEY = _TCP_ROUTING FORMAT = vesxi  props.conf [vmw-syslog] TRANSFORMS-routing=vmwaresxilogs       ... View more

[WinEventLog://Security] disabled = 0 host = ABC evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"   When we are putting this configuration in inputs.conf wherewver we are installing HF then we are seeing its forwarding the old event also. How we can define to send latest event or 7d event which is monitoring file ?     Can someone please help ?   ... View more

Hi Can someone please help me out here ? I want to forward particular event to target server and other will receive the all logs by default as it is in default group. Transforms.conf [logs_type1] REGEX = (logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called) DEST_KEY = _TCP_ROUTING FORMAT = esxireceivier   Props.conf [vmw_logs] TRANSFORMS-routing=logs_type1   Is my configuration fine or someone can help me out here ? ... View more

Please help me out. I want to route below specific keyword logs to destination on heavyforwarder. "logged out" "Rejected password for user" "Cannot login" "logged in as" "Accepted user for user" "was updated on host" "Password was changed for account" "Destroy VM called" or destory   Can someone please help on this ? ... View more

Hi, Anyone please help. We have used the username as a domain account while installation of Splunk Universal forwarder and we want to use service account in place of that ?   Can we do it without uninstallation ?     Regards Pankaj Upadhyay ... View more

Hi, I want to send all the event to two target group but do not want spend specific log event to specific target but it should get rest of the data.  This config need to be define on Splunk HF. Please help me in that. ... View more

Hi, Can we assign two different transforms.conf to same sourcetype ? For example: [sourcetype] SEDCMD-test= SEDCMD-test1= transfrom-routing=transfromA,transfromB   Tranfroms.conf [tranfromA] Regex=Error Format=target1 [tranfromA] Regex=Something Format=target1   So can i apply two different  SEDCMD syntax with same sourcetype config in props.conf ? As two SEDCMD are doing different things ?     ... View more

On forwarder, We have placed in the outputs.conf as default group of indexer so in this case all the logs by default forward to Indexer. But if i do not want to send specific logs to indexer which is in default group then what need to be done?     Please help ... View more

We have Splunk Enterprise no enforcement license of 50Gb and we have two standalone indexer. I wanna know will that license of 50gb for each indexer or combine? according to me 50gb license would be sum of each indexer utilization not individual 50gb.   Please clarify. ... View more