You inspired me, thank you. I solved the problem. It turned out that I'm doing the transformation (transforms.conf) to SplunkForwarder, I moved the transformation to Indexer and now it works. ... View more

Hi @dfratson. You've handled this exercise. I have the same problem. It looks trivially simple, but in practice, SplunkForwarder sends me the entries I deleted with [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue ... View more

I have the same problem on version 7.3.1 When I have the default props.conf file in the pdfgen file, my data quality displays problems with timestamp analysis, here are the details: 01-15-2020 11:56:18.641 +0100 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (40) characters of event. Defaulting to timestamp of previous event (Wed Jan 15 11:56:15 2020). Context: source=/opt/splunk/var/log/splunk/pdfgen.log|host=xxxxxxxxxxxxx|splunk_pdfgen|2557 When I add to my props.conf on the system / local / props.conf TIME_FORMAT =% Y-% m-% d% H:% M:% S,% 3N% z I also have the same problem. Do you have any ideas? ... View more